CVE-2026-70399 Erlang CVE debrief

Who should care

Defenders responsible for Erlang/OTP inets httpd servers, especially those not explicitly setting the max_clients option, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-70399 is a high-severity vulnerability in Erlang/OTP inets httpd that allows unauthenticated remote attackers to cause denial of service. Defenders should prioritize patching or mitigating this vulnerability, especially for servers that do not set the max_clients option explicitly.

• Denial of service via connection exhaustion
• Potential for process, memory, and file descriptor exhaustion
• Need for explicit max_clients setting to prevent unlimited connections
• Verification of server configuration and patch level required

Technical summary

The vulnerability is caused by the httpd_manager:handle_new_connection/4 function reading the max_clients option with httpd_util:lookup/2, which returns undefined when the key is absent. This allows an attacker to establish an unlimited number of connections, leading to process, memory, and file descriptor exhaustion. The max_clients option is documented to default to 150, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for servers that do not set the max_clients option explicitly.

Recommended defensive actions

• Review and apply patches or updates for Erlang/OTP inets httpd
• Explicitly set the max_clients option to a reasonable limit
• Monitor for unusual connection patterns or spikes in connection attempts
• Consider implementing rate limiting or IP blocking for suspicious traffic
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and references to source-specific vulnerability assessments. The vulnerability affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6. Defenders should verify the patch level of their Erlang/OTP inets httpd servers, especially those not explicitly setting the max_clients option, and prioritize patching or mitigation. Evidence from the CVE record and NVD entry,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.