CVE-2026-55951: CWE-770 Allocation of Resources Without Limits or Throttling in Erlang OTP

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to no limit, and the function httpc_response:parse_headers/6 accumulates all headers into a list before checking length, which only occurs after the terminating CRLF CRLF is received. This allows a malicious or compromised HTTP server to send an arbitrarily large number of headers or headers with very large values, causing the client process to allocate unbounded memory. A proof-of-concept demonstrated that sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds. The vulnerability affects OTP versions >=17.0 <27.3.4.17, >=28.0 <28.5.0.6, >=29.0 <29.0.6, and corresponding inets versions >=5.10 <9.3.2.7, >=9.4 <9.6.2.3, >=9.7 <9.7.2. No authentication is required, and any server the client connects to, including via redirects or man-in-the-middle, can trigger this exhaustion.

Exploitation of this vulnerability can cause the Erlang/OTP client process to allocate unbounded amounts of memory, potentially exhausting system memory and causing the BEAM VM to crash. This results in denial of service for applications using the vulnerable httpc client to connect to untrusted servers. No authentication is required for exploitation, increasing the risk from any malicious or compromised HTTP server or man-in-the-middle.

A fix is available in OTP versions 27.3.4.17, 28.5.0.6, and 29.0.6 and corresponding inets versions 9.3.2.7, 9.6.2.3, and 9.7.2. Users should upgrade to these fixed versions or later. Until upgraded, avoid connecting the httpc client to untrusted or potentially malicious HTTP servers. There is no indication that the vendor states 'no action required' or that the issue is already mitigated without patching.