Missing Release of Resource after Effective Lifetime in Erlang OTP - CVE-2026-69664

 

Missing Release of Resource after Effective Lifetime in Erlang OTP - CVE-2026-69664

Published: September 2, 2026


Vulnerability identifier: #VU146830
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69664
CWE-ID: CWE-772
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of resource after effective lifetime in the inets httpd chunked request body handling when processing a chunked request body with a malformed chunk size sent after the headers have already been accepted. A remote attacker can send a specially crafted chunked HTTP request and keep the connection open to cause a denial of service.

The malformed chunk-size line must be delivered in a separate write after the headers are processed; if it arrives together with the headers, the server rejects the request. No special configuration is required, and the issue is reachable in the default configuration.


Affected software

Erlang OTP

How to mitigate CVE-2026-69664

Install security update from vendor's website.

Erlang OTP - addressed in versions 17.0, 27.3.4.17, 28.5.0.6, 29.0.6

External References

Related Security Bulletins