CVE-2026-71562: httpc does not bound server-supplied numeric header values before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits.
httpchandler.erl converts the server-supplied Content-Length with listtointeger/1 before comparing it against maxbodysize, so the size check cannot protect the conversion, and the option defaults to nolimit in any case. The same unbounded conversion appears in httpcresponse:formatresponse/1 for Content-Length and in httpcresponse:getmsfromretryafter/1 for Retry-After, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Erlang/OTP inets httpcto a version that resolves this vulnerability.Fixed in 27.3.4.17 - Upgrade
Upgrade
Erlang/OTP inets httpcto a version that resolves this vulnerability.Fixed in 28.5.0.6 - Upgrade
Upgrade
Erlang/OTP inets httpcto a version that resolves this vulnerability.Fixed in 29.0.6 - Upgrade
Upgrade
Erlang/OTP inets httpcto a version that resolves this vulnerability.Fixed in 9.3.2.7 - Upgrade
Upgrade
Erlang/OTP inets httpcto a version that resolves this vulnerability.Fixed in 9.6.2.3 - Upgrade
Upgrade
Erlang/OTP inets httpcto a version that resolves this vulnerability.Fixed in 9.7.2 - Configuration
Ensure httpc does not use the default max_body_size value of "nolimit"; configure max_body_size to a finite bounded value because httpc converts server-supplied Content-Length with list_to_integer/1 before comparing against max_body_size.
Erlang/OTP inets httpc max_body_size = not specified (set to a finite, bounded value instead of default nolimit) - Compensating control
Mitigate availability impact by limiting or filtering untrusted HTTP responses (for example, ensure you only communicate with trusted/controlled HTTP servers) so an attacker cannot return numeric headers with extremely long digit runs that are converted by httpc.
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments using Erlang/OTP inets httpc to make requests to malicious or compromised HTTP servers are exposed. A server-controlled Content-Length or Retry-After value can trigger expensive arbitrary-precision integer conversion in the requesting process.
Does the default httpc configuration prevent exploitation?
No. The max_body_size option defaults to nolimit, and even when configured, Content-Length is converted with list_to_integer/1 before it is compared with max_body_size.
What does an attacker need to do to exploit this?
An attacker needs to control or compromise an HTTP server that the affected httpc client contacts. They can return a numeric header containing a very long sequence of digits; Content-Length and Retry-After are affected conversion paths.
What versions contain fixes?
Fixed releases are OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6. The corresponding fixed inets releases are 9.3.2.7, 9.6.2.3, and the affected ranges also include inets 9.7 and later through the incomplete range stated in the advisory data.