CVE-2026-70399
Erlang/OTP inets httpd accepts unlimited connections when max_clients is not set explicitly
Technology
Erlang/OTP
CVSS Score
8.7 / 10.0
Affected Versions
OTP 17.0 and later, before 27.3.4.17, 28.5.0.6 and 29.0.6 (inets)
Upstream Fix
OTP 27.3.4.17, 28.5.0.6, 29.0.6
Published
September 1, 2026
OSSeva Coverage
Fixed upstream
Description
max_clients is documented to default to 150, but inets httpd reads the option without that default, so a server that does not set it accepts any number of simultaneous connections. An unauthenticated attacker only has to open and hold enough connections to deny service; no valid request is needed.
Is your Erlang/OTP deployment affected?
If you're running OTP 17.0 and later, before 27.3.4.17, 28.5.0.6 and 29.0.6 (inets), you need this patch. Book a discovery call to get covered.