Missing Release of Resource after Effective Lifetime in Erlang OTP - CVE-2026-69664
Published: September 2, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of resource after effective lifetime in the inets httpd chunked request body handling when processing a chunked request body with a malformed chunk size sent after the headers have already been accepted. A remote attacker can send a specially crafted chunked HTTP request and keep the connection open to cause a denial of service.
The malformed chunk-size line must be delivered in a separate write after the headers are processed; if it arrives together with the headers, the server rejects the request. No special configuration is required, and the issue is reachable in the default configuration.