A critical resource exhaustion vulnerability in the Erlang/OTP inets httpd component allows unauthenticated remote attackers to trigger a denial of service on affected systems.

This is a resource management flaw (CWE-772) where the inets httpd handler fails to release worker processes when encountering specifically crafted chunked HTTP requests. An unauthenticated attacker can exhaust all available workers, effectively preventing legitimate services from functioning.

The vulnerability carries a CVSS score of 8.7, indicating a high severity due to the ease of exploitation and the potential for total service unavailability. Successful exploitation results in a denial of service, which can cause significant operational disruption, lost revenue, and impact on service level agreements. Since no authentication is required, the attack surface is exposed to any remote actor capable of reaching the service.

Immediate Action: Update Erlang/OTP to the latest versions (specifically 27.3.4.17, 28.5.0.6, 29.0.6, or higher as applicable) to incorporate the official security patches.

Proactive Monitoring: Monitor server logs and system resource usage for spikes in idle worker connections or unexpected 400 Bad Request patterns that may indicate scanning or exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or load balancer to filter out malformed HTTP chunked requests or enforce strict request timeouts at the edge to prevent resource exhaustion.

Public Exploit Available: No (exploit_available: false)

Given the ease of triggering this denial of service and the lack of required authentication, organizations should prioritize patching their Erlang/OTP deployments. Apply the provided vendor updates immediately to prevent potential service outages. In environments where patching is delayed, implement strict network-level ingress controls and WAF rules to drop suspicious malformed chunked requests.