CVE-2026-71562: CWE-1284 Improper Validation of Specified Quantity in Input in Erlang OTP

This vulnerability arises from improper validation of specified quantity inputs in Erlang/OTP's inets httpc module. The httpc_handler.erl code converts server-supplied Content-Length headers using list_to_integer/1 without bounding the input size, allowing extremely large numeric strings (up to about 1.26 million digits) to be processed. This leads to significant CPU consumption due to arbitrary-precision arithmetic, degrading availability. Similar unbounded conversions occur for Content-Length and Retry-After headers in related functions. The issue affects OTP versions from 17.0 up to but excluding 27.3.4.17, 28.0 up to but excluding 28.5.0.6, and 29.0 up to but excluding 29.0.6, as well as corresponding inets versions from 5.10 up to but excluding 9.3.2.7, 9.4 up to but excluding 9.6.2.3, and 9.7 up to but excluding 9.7.2. It is unknown if versions prior to OTP 17.0 are affected.

An attacker controlling an HTTP server can degrade the availability of a client using the vulnerable httpc module by sending headers with extremely long numeric values. This causes the client to perform costly arbitrary-precision integer conversions, resulting in increased CPU usage and response delays. There is no indication of direct code execution or data compromise, but the performance impact can disrupt normal operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to OTP versions 27.3.4.17 or later, 28.5.0.6 or later, and 29.0.6 or later, or corresponding inets versions 9.3.2.7 or later, 9.6.2.3 or later, and 9.7.2 or later once official fixes are released. Until patched, consider limiting exposure to untrusted HTTP servers or implementing application-level input validation to restrict excessively large numeric header values.