---
id: CVE-2026-70399
title: >-
  Allocation of Resources Without Limits or Throttling vulnerability in
  Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause
  denial of service by opening and holding open a large number of connections
summary: >-
  Allocation of Resources Without Limits or Throttling vulnerability in
  Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause
  denial of service by opening and holding open a large number of connections.
  The max_clients …
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-770
vendor: Erlang
product: otp
affected:
  - otp >= 17.0 < 27.3.4.17
  - otp >= 28.0 < 28.5.0.6
  - otp >= 29.0 < 29.0.6
  - inets >= 5.10 < 9.3.2.7
  - inets >= 9.4 < 9.6.2.3
  - inets >= 9.7 < 9.7.2
  - erlang/otp >= d9674f32811cd5bb02b0d6656053b5ee226bc74c < *
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T01:17:52.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70399'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-70399.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/e0050fc00c500a4fa9ba1f594603c787ff6d20b2
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://github.com/erlang/otp/security/advisories/GHSA-pwvh-c689-f8q5'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-70399'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://www.erlang.org/doc/system/versions.html#order-of-versions'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70399.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-70399'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2526832'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-70399'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70399'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-01T15:52:45.671034Z'
cvssSource: cna
epss: 0.00533
epssPercentile: 0.4376
ingestedAt: '2026-09-08T15:33:26.956Z'
scores:
  cna: 8.7
  vendor: 7.5
---

## Overview

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.

The accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring get_ustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70399.json)