CVE-2026-71562: Erlang/OTP inets httpc DOS Vulnerability

CVE-2026-71562 Overview

CVE-2026-71562 is a denial-of-service vulnerability in the Erlang/OTP inets HTTP client (httpc). A malicious or compromised HTTP server can return a numeric header whose value is a very long run of digits, forcing the client to perform costly arbitrary-precision integer conversion. The flaw is classified as Improper Validation of Specified Quantity in Input [CWE-1284]. Affected numeric headers include Content-Length and Retry-After. Values of up to roughly 1.26 million digits parse successfully and consume hundreds of milliseconds of CPU per response in the requesting process.

Critical Impact
Any Erlang application using httpc to reach untrusted or compromised HTTP servers can suffer sustained CPU exhaustion in the calling process, degrading availability of dependent services.

Affected Products

Erlang/OTP from OTP 17.0 before OTP 27.3.4.17 (inets from 5.10 before 9.3.2.7)
Erlang/OTP from OTP 28.0 before OTP 28.5.0.6 (inets from 9.4 before 9.6.2.3)
Erlang/OTP from OTP 29.0 before OTP 29.0.6 (inets from 9.7 before 9.7.2)

Discovery Timeline

2026-09-01 - CVE-2026-71562 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-71562

Vulnerability Analysis

The Erlang httpc client parses numeric HTTP response headers by passing raw server-supplied strings to list_to_integer/1. This built-in accepts integers of arbitrary size, so the cost of conversion grows with the digit length. A hostile server can supply a Content-Length or Retry-After value consisting of over a million digits. Each such response burns significant CPU on the requesting process, blocking other work scheduled on the same Erlang process and reducing throughput of the calling application.

Root Cause

httpc_handler.erl converts the server-supplied Content-Length with list_to_integer/1 before comparing it against max_body_size. The size check therefore cannot bound the conversion itself, and max_body_size defaults to nolimit. The same unbounded conversion occurs in httpc_response:format_response/1 for Content-Length and in httpc_response:get_ms_from_retry_after/1 for Retry-After. The latter is only guarded by a check that the first character is a digit, which does not constrain length. Because list_to_integer/1 is documented to accept integers of any size, bounding the input is the caller's responsibility.

Attack Vector

An attacker who controls an HTTP server, or who compromises or man-in-the-middles one contacted by an Erlang client, returns a response containing a header such as Content-Length: 111...1 with roughly 1.26 million digits. When httpc processes the response, the requesting process performs bignum arithmetic that consumes hundreds of milliseconds of CPU. Repeated responses amplify the impact and degrade availability.

text

// Security patch: lib/inets/src/http_client/httpc_handler.erl
// Propagates max_header_size and max_body_size into the handler state
// so response parsing can enforce bounds before invoking list_to_integer/1.

    handle_verbose(Options#options.verbose),
    ProxyOptions = handle_proxy_options(Request#request.scheme, Options),
    Address = handle_proxy(Request#request.address, ProxyOptions),
+   MaxHeaderSize = proplists:get_value(max_header_size, Request#request.request_options),
+   MaxBodySize = proplists:get_value(max_body_size, Request#request.request_options),
    {ok, State} =
        case {Address /= Request#request.address, Request#request.scheme} of
            {true, https} ->
                connect_and_send_upgrade_request(Address, Request,
-                                                #state{options = Options,
+                                                #state{max_header_size = MaxHeaderSize,
+                                                       max_body_size = MaxBodySize,
+                                                       options = Options,
                                                        profile_name = ProfileName});
            {_, _} ->
                connect_and_send_first_request(Address, Request,
-                                  #state{options = Options,
+                                  #state{max_header_size = MaxHeaderSize,
+                                         max_body_size = MaxBodySize,
+                                         options = Options,
                                          profile_name = ProfileName})
        end,
    gen_server:enter_loop(?MODULE, [], State).

Source: GitHub OTP Commit aba0fe8

Detection Methods for CVE-2026-71562

Indicators of Compromise

HTTP responses containing Content-Length or Retry-After header values with abnormally long digit sequences (thousands to millions of digits).
Erlang application logs or telemetry showing spikes in per-request CPU time correlated with outbound httpc calls.
Increased scheduler run-queue latency in Erlang VMs that make outbound HTTP requests to third-party services.

Detection Strategies

Inspect proxy or egress traffic for HTTP response headers whose numeric fields exceed a sane upper bound (for example, more than 20 characters).
Instrument Erlang applications with per-request timing around httpc:request/1,2,4,5 and alert on outliers.
Monitor Erlang/OTP process reductions and message queue depth for httpc_handler processes handling external endpoints.

Monitoring Recommendations

Collect and centralize HTTP client latency metrics into a SIEM or observability pipeline and baseline normal response-parsing time.
Alert when the same remote host repeatedly triggers sub-second CPU spikes in httpc workers.
Track OTP and inets versions across the estate and flag hosts still running vulnerable releases.

How to Mitigate CVE-2026-71562

Immediate Actions Required

Upgrade Erlang/OTP to 27.3.4.17, 28.5.0.6, or 29.0.6 (or later), corresponding to inets9.3.2.7, 9.6.2.3, or 9.7.2.
Inventory all services that call httpc against third-party or internet-exposed HTTP endpoints and prioritize those for patching.
Restrict outbound HTTP calls from Erlang workloads to known-good destinations through an egress proxy.

Patch Information

The fixes propagate max_header_size and max_body_size into the httpc_handler state and bound integer parsing before invoking list_to_integer/1. See the GitHub Security Advisory GHSA-cqx9-9hq6-m8wf, the CNA advisory for CVE-2026-71562, and commits aba0fe8 and e3be1cf.

Workarounds

Set the max_header_size option on httpc profiles to a small value (for example, 8192) so oversized header lines are rejected before parsing.
Route outbound HTTP through a reverse proxy that normalizes or drops responses with malformed numeric headers.
Limit exposure by validating and constraining the set of remote hosts that Erlang workloads are permitted to contact.

bash

# Example: configure an httpc profile with a bounded max_header_size
# in an Erlang shell or application startup code
httpc:set_options([{max_header_size, 8192}, {max_body_size, 10485760}], my_profile).