CVE-2026-55951
published 2026-09-01CVE-2026-55951: The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to…
PriorityP349high8.2CVSS 4.0
AVNACLATPPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.69%
52.4th percentile
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).
A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.
Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| erlang | otp | >= 17.0 < 27.3.4.17 | 27.3.4.17 |
| erlang | otp | >= 28.0 < 28.5.0.6 | 28.5.0.6 |
| erlang | otp | >= 29.0 < 29.0.6 | 29.0.6 |
| erlang | otp | >= 5.10 < 9.3.2.7 | 9.3.2.7 |
| erlang | otp | >= 84adefa331c4159d432d22840663c38f155cd4c1 < * | * |
| erlang | otp | >= 9.4 < 9.6.2.3 | 9.6.2.3 |
| erlang | otp | >= 9.7 < 9.7.2 | 9.7.2 |
| ubuntu | erlang | — | — |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Erlang OTP prior 27.3.4.17/28.5.0.6/29.0.6 HTTP Client httpc_response:parse_headers allocation of resources (WID-SEC-2026-3146)
vuldb·2026-09-03·CVSS 8.2
CVE-2026-55951 [HIGH] Erlang OTP prior 27.3.4.17/28.5.0.6/29.0.6 HTTP Client httpc_response:parse_headers allocation of resources (WID-SEC-2026-3146)
A vulnerability has been found in Erlang OTP and classified as problematic. Affected is the function httpc_response:parse_headers of the component HTTP Client. The manipulation leads to allocation of resources.
This vulnerability is referenced as CVE-2026-55951. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
Ubuntu
Erlang vulnerabilities
vendor_ubuntu·2026-09-28·CVSS 7.5
CVE-2026-23941 [HIGH] Erlang vulnerabilities
Title: Erlang vulnerabilities
Summary: Several security issues were fixed in Erlang.
It was discovered that the Erlang Port Mapper Daemon did not properly
handle slow connections. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2026-42792)
It was discovered that Erlang incorrectly handled certain external term
format data, leading to heap corruption. An attacker could possibly use
this issue to cause Erlang to crash, resulting in a denial of service.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-55737)
It was discovered that Erlang incorrectly handled invalid external term
format data. An attacker could possibly use this issue to cause Erlang to
crash, resulting in a denial of service. This issue only affected Ubuntu
26.04
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cna.erlef.org/cves/CVE-2026-55951.htmlhttps://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042dhttps://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aahttps://github.com/erlang/otp/security/advisories/GHSA-f9fw-mg7q-4g3xhttps://osv.dev/vulnerability/EEF-CVE-2026-55951https://www.erlang.org/doc/system/versions.html#order-of-versions
2026-09-01
Published