# CVE-2026-70399: httpd does not enforce the documented default max_clients connection limit

Status: published. Published: 2026-09-01. Updated: 2026-11-11.

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.

The accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring get_ustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2.

## Remediation

- workaround: * Set max_clients explicitly in the httpd configuration, for example {max_clients, 150}. An explicitly configured value is read by the same accept gate and applied as intended, so this restores the documented limit without upgrading.
* Limit concurrent connections in front of httpd, for example with reverse proxy or firewall connection-count and connection-rate rules.
* Restrict access to the server to trusted clients where the deployment allows it. (source: CNA: EEF)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/e0050fc00c500a4fa9ba1f594603c787ff6d20b2

## Affected products and versions

- Erlang / OTP (otp): ≥ 17.0; < * (affected, otp); unaffected at 27.3.4.17; unaffected at 28.5.0.6; unaffected at 29.0.6. Source: CNA: EEF
- Erlang / OTP (inets): ≥ 5.10; < * (affected, otp); unaffected at 9.3.2.7; unaffected at 9.6.2.3; unaffected at 9.7.2. Source: CNA: EEF
- Erlang / OTP (erlang/otp): ≥ d9674f32811cd5bb02b0d6656053b5ee226bc74c; < * (affected, git); unaffected at d94a94c96eb4cccbd6f7d7da5975f0c035b69612; unaffected at 6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7; unaffected at e0050fc00c500a4fa9ba1f594603c787ff6d20b2. Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 8.7 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N; source: CNA: EEF

- CISA KEV: No listing in collected sources

- EPSS: 0.93% as of 2026-11-10; percentile 60.81%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-770

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/erlang/otp/security/advisories/GHSA-pwvh-c689-f8q5 (CNA: EEF; vendor-advisory, related)

- https://cna.erlef.org/cves/CVE-2026-70399.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-70399 (CNA: EEF; related)

- https://www.erlang.org/doc/system/versions.html#order-of-versions (CNA: EEF; x_version-scheme)

- https://github.com/erlang/otp/commit/d9674f32811cd5bb02b0d6656053b5ee226bc74c (CNA: EEF; related)

- https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612 (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7 (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/e0050fc00c500a4fa9ba1f594603c787ff6d20b2 (CNA: EEF; patch)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-70399; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-70399; retrieved 2026-11-11; source updated Not reported

Revision: bdc4187df4d0aeee6a83cedad24c9aa7a3a45324d0e60b157a1568940267a886

Canonical: https://y2.dev/cve/CVE-2026-70399

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.