CVE-2026-55951 in OTP
Summary
by MITRE • 09/01/2026
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).
A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.
Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/01/2026
The Erlang/OTP httpc HTTP client module contains a critical resource exhaustion vulnerability stemming from the lack of enforced limits on the total size of response headers received during an HTTP transaction. This flaw allows a malicious or compromised server to trigger a denial-of-service condition by sending arbitrarily large numbers of headers or headers with excessively large values, causing the client process to allocate unbounded memory until the system runs out of resources or the BEAM virtual machine crashes entirely. The root cause lies in the implementation details of httpc_response:parse_headers/6, which accumulates every header into a list before performing any length checks. This check is only triggered after the terminating CRLF sequence indicating the end of headers has been received, meaning that during the parsing phase, there are no intermediate safeguards to prevent memory consumption from growing uncontrollably.
The operational impact of this vulnerability is severe for any application utilizing httpc:request/4 or httpc/request/5 when connecting to untrusted servers. Because no authentication is required, an attacker can exploit this flaw simply by hosting a malicious HTTP server that responds with the crafted header payload. The attack surface includes not only direct connections but also scenarios involving automatic redirects and man-in-the-middle attacks where the client may be redirected through multiple hops before reaching the final destination or encountering intermediate proxies that inject headers. In practical demonstrations, sending one hundred thousand headers of approximately four kilobytes each caused the client VM to allocate over thirteen gigabytes of memory in under thirty seconds, illustrating the rapidity and severity of the resource depletion. This behavior aligns with CWE-787: Out-of-bounds Write and CWE-400: Uncontrolled Resource Consumption, as the system fails to properly bound input size leading to excessive allocation.
From a threat intelligence perspective, this vulnerability maps directly to MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via application layer protocols. The attack vector is classified as Network (ATT&CK T1078) if the attacker controls an intermediate server or proxy, or Remote Code Execution implications may arise indirectly through system instability leading to service disruption in critical infrastructure environments. The vulnerability affects Erlang/OTP versions from 17.0 up to but not including 27.3.4.17, as well as OTP 28.x prior to 28.5.0.6 and OTP 29.0 prior to 29.0.6. These correspond to the inets module versions from 5.10 up to but not including 9.3.2.7, version 9.4 through 9.6.2.3, and version 9.7 through 9.7.2. It remains unknown whether earlier OTP releases predating 17.0 are affected due to significant architectural changes in the httpc implementation over time.
Mitigation strategies must prioritize immediate patching of the Erlang/OTP runtime environment to a fixed release where header size limits are enforced during parsing rather than after completion. For environments unable to upgrade immediately, developers should implement external proxies or reverse proxy configurations that strip or limit response headers before they reach the client application. Additionally, applications can be hardened by configuring connection timeouts and monitoring process memory usage closely using Erlang's built-in diagnostics tools such as erlang:process_info/2 to detect abnormal memory growth indicative of an ongoing attack. Security teams should also audit all outbound HTTP requests made via httpc to ensure they do not interact with untrusted or potentially compromised endpoints without appropriate network-level filtering and inspection capabilities in place.