Skip to content
Fencer Vulns
high 8.7

CVE-2026-69664 json

httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

published 2026-09-01 2 mo ago modified 2026-09-22 48 d ago also EUVD-2026-69381

cvss
8.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Patch / fix

  • Erlang OTP 9.3.2.7, 9.6.2.3, 9.7.2, 27.3.4.17, 28.5.0.6, 29.0.6
  • erlang Debian 13 1:27.3.4.1+dfsg-1+deb13u4
  • erlang Debian 14 1:29.0.6+dfsg-1

debian advisories DEBIAN-CVE-2026-69664

  • erlang Ubuntu 22.04 LTS 1:24.2.1+dfsg-1ubuntu0.7
  • erlang Ubuntu 24.04 LTS 1:25.3.2.8+dfsg-1ubuntu4.7
  • erlang Ubuntu 26.04 LTS 1:27.3.4.6+dfsg-1ubuntu0.1
  • erlang Ubuntu Pro 14.04 LTS 1:16.b.3-dfsg-1ubuntu2.2+esm2
  • erlang Ubuntu Pro 16.04 LTS 1:18.3-dfsg-1ubuntu3.1+esm3
  • erlang Ubuntu Pro 18.04 LTS 1:20.2.2+dfsg-1ubuntu2+esm3
  • erlang Ubuntu Pro 20.04 LTS 1:22.2.7+dfsg-1ubuntu0.5+esm2

ubuntu advisories UBUNTU-CVE-2026-69664

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • erlang27 hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-et hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-wx hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-ftp hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-ssh hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-ssl hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-asn1 hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-edoc hummingbird 1 27.3.4.17-0.1.hum1

red hat advisories RHSA-2026:62531

  • erlang Azure Linux 3.0 26.2.5.21-6

azure linux advisories AZL-98466

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-69664 updated cvss 7.5

otp: inets: Erlang/OTP inets httpd: Denial of Service via malformed chunked HTTP request

  • Red Hat OpenStack Platform 16.2 erlang, erlang-ssl, erlang-asn1, erlang-erts, erlang-hipe, erlang-sasl, +15 more Red Hat OpenStack Platform 17.1 erlang-ssl, erlang-asn1, erlang-erts, erlang-sasl, erlang-snmp, erlang-eldap, +13 more Red Hat OpenStack Platform 18.0 erlang
    affected: workaround, no fix available
  • Red Hat Hardened Images erlang27 27.3.4.17-0.1.hum1
    fixed: vendor fix RHSA-2026:62531
  • Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9 Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/erlang/otp/security/advisories/GHSA-mr35-8h7w-w3gq referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Erlang OTP

Classification

Weakness
  • CWE-772 Missing Release of Resource after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.