{"affected":[{"defaultStatus":"unaffected","ecosystem":"software-id","packageName":"otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"27.3.4.17","status":"unaffected"},{"at":"28.5.0.6","status":"unaffected"},{"at":"29.0.6","status":"unaffected"}],"lessThan":"*","status":"affected","version":"17.0","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"otp","packageName":"inets","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"9.3.2.7","status":"unaffected"},{"at":"9.6.2.3","status":"unaffected"},{"at":"9.7.2","status":"unaffected"}],"lessThan":"*","status":"affected","version":"5.10","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"erlang/otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"d94a94c96eb4cccbd6f7d7da5975f0c035b69612","status":"unaffected"},{"at":"6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7","status":"unaffected"},{"at":"e0050fc00c500a4fa9ba1f594603c787ff6d20b2","status":"unaffected"}],"lessThan":"*","status":"affected","version":"d9674f32811cd5bb02b0d6656053b5ee226bc74c","versionType":"git"}]}],"cveId":"CVE-2026-70399","cwes":["CWE-770"],"description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.\n\nThe accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring get_ustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2.","epss":{"date":"2026-11-10","percentile":0.60807,"score":0.00927},"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794406048956,"publishedAt":1788273185717,"references":[{"source":"CNA: EEF","tags":["vendor-advisory","related"],"url":"https://github.com/erlang/otp/security/advisories/GHSA-pwvh-c689-f8q5"},{"source":"CNA: EEF","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-70399.html"},{"source":"CNA: EEF","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-70399"},{"source":"CNA: EEF","tags":["x_version-scheme"],"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"source":"CNA: EEF","tags":["related"],"url":"https://github.com/erlang/otp/commit/d9674f32811cd5bb02b0d6656053b5ee226bc74c"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/e0050fc00c500a4fa9ba1f594603c787ff6d20b2"}],"remediation":[{"kind":"workaround","source":"CNA: EEF","text":"* Set max_clients explicitly in the httpd configuration, for example {max_clients, 150}. An explicitly configured value is read by the same accept gate and applied as intended, so this restores the documented limit without upgrading.\n* Limit concurrent connections in front of httpd, for example with reverse proxy or firewall connection-count and connection-rate rules.\n* Restrict access to the server to trusted clients where the deployment allows it."},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/e0050fc00c500a4fa9ba1f594603c787ff6d20b2"}],"revision":"bdc4187df4d0aeee6a83cedad24c9aa7a3a45324d0e60b157a1568940267a886","sources":[{"modifiedAt":1794406048956,"name":"CNA: EEF","retrievedAt":1794409741454,"url":"https://www.cve.org/CVERecord?id=CVE-2026-70399"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794409762748,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70399"}],"ssvc":{"assessedAt":1788277965671,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"httpd does not enforce the documented default max_clients connection limit","updatedAt":1794409762748}