CVE-2026-71380: CWE-772 Missing Release of Resource after Effective Lifetime in Erlang OTP

This vulnerability (CWE-772) in Erlang/OTP inets httpd occurs because the httpd_request_handler cancels the request timeout after successfully parsing headers but does not set a new timeout when waiting for the request body. If an attacker sends a valid request header with a large Content-Length but stalls before sending the full body, the worker handling the request waits indefinitely. The periodic byte-rate check that could reclaim the worker is only enabled if minimum_bytes_per_second is configured, which is not the default. By repeating this attack across multiple connections, an attacker can exhaust all available workers (max_clients), causing a denial of service at minimal bandwidth cost. The issue affects OTP versions from 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, and 29.0 before 29.0.6, corresponding to inets versions from 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, and 9.7 before 9.7.2. It is unknown whether versions before OTP 17.0/inets 5.10 are affected.

An unauthenticated remote attacker can cause a denial of service by exhausting all available httpd worker processes through sending partial HTTP requests with large Content-Length headers and stalling the request body transmission. This leads to resource exhaustion and denial of service to legitimate clients. No code execution or data disclosure is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a workaround, configuring minimum_bytes_per_second to enable the periodic byte-rate check can mitigate indefinite worker occupation. Upgrading to fixed versions of Erlang/OTP and inets as listed is recommended once official patches are available.