CVE-2026-70399: CWE-770 Allocation of Resources Without Limits or Throttling in Erlang OTP

This vulnerability arises because the inets httpd server in Erlang/OTP does not enforce the documented default limit of 150 max_clients unless explicitly configured. The accept gate reads the max_clients option but returns undefined if the key is absent, causing the guard that should reject excess connections to always succeed. As a result, an attacker can open and hold a large number of connections without authentication or valid requests, consuming worker processes, memory, and file descriptors, leading to denial of service. The issue affects OTP versions from 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, and 29.0 before 29.0.6, and corresponding inets versions from 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, and 9.7 before 9.7.2. Servers with an explicitly set max_clients value are not affected.

An unauthenticated remote attacker can cause denial of service by exhausting server resources such as processes, memory, and file descriptors through opening and holding many simultaneous connections. No valid requests or authentication are required to exploit this vulnerability. This can degrade or disrupt service availability on affected Erlang/OTP inets httpd servers that do not explicitly configure max_clients.

A fix is available in Erlang/OTP versions 27.3.4.17, 28.5.0.6, and 29.0.6 and corresponding inets versions 9.3.2.7, 9.6.2.3, and 9.7.2. Users should upgrade to these or later versions. Alternatively, explicitly setting the max_clients option to a reasonable limit prevents the vulnerability by enforcing connection limits as intended.