An unauthenticated remote denial of service vulnerability in Erlang/OTP allows attackers to exhaust system resources by opening unlimited connections, necessitating an immediate update.

The vulnerability is an allocation of resources without limits (CWE-770) within the inets httpd component. Due to a logic error in the connection manager, the server fails to apply the default connection limit of 150 when the max_clients option is absent, allowing an unauthenticated attacker to exhaust memory and file descriptors.

Successful exploitation of this vulnerability results in a denial of service, which can cause significant operational disruption by rendering the Erlang application unresponsive. With a CVSS score of 8.7, the severity is high because the attack vector is network-based, requires no authentication, and is trivial to execute against unconfigured servers.

Immediate Action: Update your Erlang/OTP installation to the patched versions (OTP 27.3.4.17, 28.5.0.6, 29.0.6 or later) as specified in the vendor advisory. If an immediate update is not feasible, explicitly configure the max_clients option in your inets httpd configuration to enforce the intended connection limits.

Proactive Monitoring: Monitor system logs and process telemetry for sudden spikes in socket connections or memory usage associated with the Erlang node.

Compensating Controls: Deploy a Web Application Firewall or load balancer in front of the Erlang service to rate-limit incoming connections and block suspicious traffic patterns.

Public Exploit Available: No

The risk posed by this vulnerability is significant due to the ease of exploitation and the potential for complete service unavailability. Organizations utilizing Erlang/OTP should verify their current configuration to see if max_clients is explicitly set, but must prioritize upgrading to the provided patched versions to permanently resolve the underlying logic error.