An unauthenticated remote denial of service vulnerability in Erlang/OTP allows attackers to exhaust system resources with minimal bandwidth by stalling HTTP requests.

This is a missing release of resource after effective lifetime (CWE-772) flaw in the inets httpd module. An unauthenticated attacker can send a request with a large Content-Length header and subsequently stall the transfer, causing the server to hold the connection open indefinitely and exhaust available worker threads.

The vulnerability carries a CVSS score of 8.7, reflecting its high impact on service availability. Because the attack requires negligible bandwidth and no authentication, an adversary can easily disrupt critical business services, leading to significant downtime and potential operational failure for systems relying on the Erlang/OTP inets server.

Immediate Action: Update Erlang/OTP to the latest patched versions (specifically 27.3.4.17, 28.5.0.6, 29.0.6 or later) as provided in the vendor security advisory.

Proactive Monitoring: Monitor server logs for an unusual accumulation of stalled or incomplete HTTP requests and track worker thread utilization metrics to identify potential ongoing exhaustion attempts.

Compensating Controls: If immediate patching is not feasible, configure the minimum_bytes_per_second setting in the inets httpd configuration to enforce connection timeouts for slow-reading clients.

Public Exploit Available: Unknown

Given the high severity score and the ease of exploitation, organizations running affected versions of Erlang/OTP must prioritize applying the provided patches. Failure to remediate this vulnerability leaves infrastructure susceptible to trivial denial of service attacks that can result in prolonged service unavailability.