CVE-2026-71380 describes a missing release of resource vulnerability in Erlang/OTP's inets httpd server. The httpd_request_handler cancels request timeouts after headers are parsed but does not set further timers when waiting for the request body, allowing an attacker to stall connections by sending incomplete bodies with large Content-Length headers. Without the minimum_bytes_per_second configuration enabled (which is off by default), workers remain indefinitely occupied, leading to denial of service by exhausting max_clients workers. This affects OTP versions from 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, and 29.0 before 29.0.6, corresponding to inets versions from 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, and 9.7 before 9.7.2. The vulnerability allows denial of service at negligible bandwidth cost.

An unauthenticated remote attacker can cause a denial of service by exhausting all available worker processes in the Erlang/OTP inets httpd server. This prevents legitimate clients from accessing the service. The attack requires minimal bandwidth and exploits the server's handling of incomplete HTTP request bodies. There is no indication of code execution or data compromise.

A patch is available and should be applied to affected Erlang/OTP versions. The vendor advisory from Ubuntu (USN-8827-1) confirms fixes in updated package versions for multiple Ubuntu LTS releases. After applying updates, a system reboot is recommended to ensure all changes take effect. Configuring minimum_bytes_per_second may provide additional mitigation but is not enabled by default. Users should follow vendor instructions for updating Erlang packages to fixed versions.