CVE-2026-69664: httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
Other sources
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.5.21-6 - Upgrade
Upgrade
debian/erlangto a version that resolves this vulnerability.Fixed in 1:29.0.6+dfsg-1Fixed in 1:29.1.1+dfsg-1 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 27.3.4.17 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 28.5.0.6 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 29.0.6
Event History
Frequently Asked Questions
Are deployments using the default httpd configuration exposed?
Yes. The default configuration is affected, and exploitation does not require authentication.
What request delivery pattern is required to trigger the worker leak?
The attacker must send a chunked request body with a non-hexadecimal chunk-size line, with that line delivered in a separate write after the headers. If the body arrives together with the headers, the server instead responds with 400 Bad Request.
How can this become a service-wide outage?
Each triggering connection leaves its serving worker waiting indefinitely, with no timeout reclaiming it. Repeating the request across connections can occupy all available workers and prevent legitimate clients from being served.
Why might a malformed chunked request not reproduce the issue in a simple single-write test?
When the malformed chunk-size line accompanies the headers, the decoder error is caught and handled as a 400 Bad Request. The vulnerable path occurs only when decoding is resumed after the headers have already been processed.