CVE-2026-70399: httpd does not enforce the documented default max_clients connection limit
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.
The accept gate in httpdmanager:handlenewconnection/4 reads the option with httpdutil:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring getustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set maxclients explicitly are unaffected, because a configured value is applied as intended.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Explicitly set the httpd max_clients option to 150. Servers that set max_clients explicitly are unaffected; the documented default limit is not enforced when max_clients is left unset.
inets httpd max_clients = 150
Event History
Frequently Asked Questions
Which deployments are exposed?
Erlang/OTP inets httpd servers that do not explicitly set the max_clients option are exposed. Servers with max_clients explicitly configured are unaffected by this missing-default behavior.
What does an attacker need to do to trigger the denial of service?
An unauthenticated remote attacker only needs to establish and keep many connections open to the httpd service. No valid HTTP request or authentication is required.
What resources are consumed during an attack?
Each accepted held-open connection consumes a worker process and a socket. Sufficient connections can drive the node toward process, memory, and file descriptor exhaustion.
What can be done before a patch is available?
Explicitly configure max_clients to a numeric connection limit rather than relying on its documented default. Setting it explicitly restores enforcement of the configured limit; the documented default value is 150.