CVE-2026-71380: httpd applies no timeout while receiving a request body, parking a worker on a stalled client
httpd applies no timeout while receiving a request body, parking a worker on a stalled client
Other sources
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.5.21-6 - Upgrade
Upgrade
debian/erlangto a version that resolves this vulnerability.Fixed in 1:29.0.6+dfsg-1Fixed in 1:29.1.1+dfsg-1 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 27.3.4.17 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 28.5.0.6 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 29.0.6
Event History
Frequently Asked Questions
Is the default httpd configuration affected?
Yes. The periodic byte-rate check that can reclaim stalled request workers is only enabled when minimum_bytes_per_second is configured, and it is not configured by default.
What does an attacker need to do to exhaust the service?
An unauthenticated remote attacker can send valid request headers declaring a large Content-Length, then stop sending the request body before it is complete. Each such connection can leave a worker waiting indefinitely.
How much service capacity can this consume?
Repeating the stalled requests across connections can occupy every worker allowed by max_clients. Once those workers are occupied, legitimate clients can be denied service at negligible attacker bandwidth cost.
What mitigation is available if upgrading cannot happen immediately?
Configure minimum_bytes_per_second so the periodic byte-rate check is armed and can reclaim stalled requests. The issue affects OTP 17.0 before 27.3.4.17, OTP 28.0 before 28.5.0.6, and OTP 29.0 before 29.0.6.