The Erlang/OTP inets httpd server has an allocation of resources without limits or throttling vulnerability (CVE-2026-70399) that permits unauthenticated remote attackers to cause denial of service by opening and maintaining many simultaneous connections. The vulnerability stems from the server's failure to apply the default max_clients limit of 150 when the option is not explicitly set, due to a logic flaw in option lookup and Erlang term ordering. Each accepted connection consumes a worker process and socket, leading to exhaustion of process, memory, and file descriptors. This affects OTP versions from 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, and 29.0 before 29.0.6, corresponding to inets versions from 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, and 9.7 before 9.7.2. Servers that explicitly set max_clients are not vulnerable. A patch is available from Ubuntu and other vendors.

An unauthenticated remote attacker can cause denial of service by exhausting server resources through unlimited simultaneous connections. This leads to process, memory, and file descriptor exhaustion, potentially rendering the Erlang/OTP inets httpd server unavailable. No authentication or valid requests are required to exploit this vulnerability.

A patch is available and should be applied to affected systems. Explicitly setting the max_clients option to a finite value also mitigates the issue. Refer to the Ubuntu security notice USN-8827-1 for updated package versions and apply updates accordingly. After updating, a system reboot is recommended to ensure all changes take effect.