CVE-2026-69664: Erlang/OTP inets httpd parks request worker indefinitely on malformed chunk size sent after headers unauthenticated remote DoS

In Erlang/OTP's built-in inets HTTP server (httpd), a request that uses Transfer-Encoding: chunked and whose chunk-size line arrives in a TCP write separate from the headers is decoded through a continuation invoked via a bare catch in httpd_request_handler:handle_info/2. When the chunk-size line is not valid hexadecimal (e.g. ZZZ\r\n), http_chunk:decode_size/4 throws {error, {chunk_size, Line}}; the bare catch flattens this throw into a plain term that matches none of the error clauses, so it falls into the catch-all NewMFA clause: the error tuple is stored as the next decoder continuation and the socket is re-armed with {active, once}. Because the request timeout was already cancelled when the headers were accepted and minimum_bytes_per_second is disabled by default, no timer ever reclaims the worker — it is parked indefinitely while the attacker keeps the TCP connection open with zero further bytes. Repeating this across connections exhausts the request-worker pool (max_clients, documented default 150) and denies service to legitimate clients (CWE-772, Missing Release of Resource after Effective Lifetime).

• Package/component affected: lib/inets http_server/httpd_request_handler.erl (interaction with http_server/http_chunk.erl decode_size/4)
• Affected versions: Erlang/OTP >= 18.1.4 < 27.3.4.17 | >= 28.0 < 28.5.0.6 |

  = 29.0 < 29.0.6 (inets >= 6.0.3 < 9.3.2.7 | >= 9.4 < 9.6.2.3 | >= 9.7 < 9.7.2). Introduced by commit 77acb473d8f056f6f534395f131c6e45693797f0. Tested here: OTP-27 maintenance line, vulnerable commit e9f49f57cef6e38fd13c4b0cee1eb5509ef471e8 (parent of the fix; inets 9.3.2.6).

• Risk level and consequences: High (CVSS 8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H). Unauthenticated remote attacker, default configuration, availability-only impact: each parked connection permanently consumes one request-handler process and one socket until the attacker voluntarily disconnects; enough such connections make the server answer every new client with 503 Service Unavailable ("heavy load").

Impact Parity

• Disclosed/claimed maximum impact: Unauthenticated remote denial of service against the default inets httpd configuration (dos).
• Reproduced impact from this run: dos — full remote denial of service demonstrated end-to-end over the real TCP listener:
  • a single segmented request parks a httpd_request_handler process indefinitely (the same process pid observed alive with {message_queue_len,0},{status,waiting} and zero traffic for the full 165 s observation window, beyond the 150 s default keep-alive timeout; no response is ever sent to the parked socket);
  • a 300-connection exhaustion wave of identical parked requests fills the worker pool at the documented max_clients default of 150 (confirmed against the server-side census before the probe is fired), after which fresh legitimate GET requests are denied with 503 Service Unavailable ("heavy load"); the denial persists while the attacker holds the sockets (re-verified after a 25 s wait, census still pinned at 150) and disappears only after the attacker disconnects (census drops to 0, legit 200);
  • the fixed build (fix commit a3adf630...) responds 400 Bad Request immediately on the exact same segmented input, closes the connection, reclaims the worker (census 0), and the same 300-connection wave cannot deny service to legitimate clients (200 throughout).
• Parity: full (claimed DoS fully demonstrated; no code execution was claimed or observed).
• Not demonstrated: none — no impact beyond availability was claimed.

Root Cause

httpd_request_handler.erl, handle_info({Proto, Socket, Data}, ...) clause (vulnerable code, line 241 of the tested checkout):

PROCESSED = (catch Module:Function([Data | Args])),
...
case PROCESSED of
    {ok, Result} -> ...;
    {error, {size_error, ...}, Version} -> ...;
    {error, {version_error, ...}, Version} -> ...;
    {error, {bad_request, ...}, Version} -> ...;
    {http_chunk = Module, Function, Args} when ChunkState =/= undefined -> ...;
    NewMFA ->
        setopts(Socket, SockType, [{active, once}]),
        {noreply, State#state{mfa = NewMFA}}   %% <-- parks here
end

Flow for a chunked request:

1. Headers arrive; httpd_request:parse/2 returns {ok, {continue, http_chunk, decode_size, Args}}; handle_msg/2 sets mfa = {http_chunk, decode_size, Args} after the request timeout was cancelled in the {ok, ...} branch (cancel_request_timeout/1). No new timer is armed; minimum_bytes_per_second is false by default, so data_receive_counter/2 arms nothing either.
2. The chunk-size line arrives in a later TCP write, so handle_info({tcp, Socket, Data}, ...) runs with Module = http_chunk, Function = decode_size.
3. http_chunk:decode_size(<<"ZZZ\r\n">>, ...) throws {error, {chunk_size, Line}} for a non-hex chunk size.
4. The bare catch converts the throw into the plain term {error, {chunk_size, Line}}, which matches no clause of the case (the {error, ...} clauses expect 3-tuples with a Version), so the catch-all NewMFA clause stores the error tuple as the next continuation MFA and re-arms the socket with {active, once}.
5. The attacker sends no more bytes; no timeout exists; the worker waits forever (only tcp_closed would free it). Each such connection leaks one handler process + one socket until client disconnect.

Note the contrast that proves segmentation matters: when the body arrives together with the headers, handle_body/3 calls http_chunk:decode/... inside a proper try ... catch and returns 400 Bad Request — that path was never vulnerable. The trigger requires the chunk-size line to arrive in a later write, exactly as the advisory states.

• Fix: OTP maintenance commits a3adf63078438c86527d704e23282b7721d8ca12 (OTP 27), df1a9ca4666e2fdfc44886bfaae76de086d803f6 (OTP 28), bd4e74348c6be8a49f060da6fd48d43f3a960292 (OTP 29). The fix wraps the decoder call as catch throw:{error, Error} when Module =:= http_chunk -> (line 287 in the fixed tree) so a thrown chunk-decode error is routed to the error handling that sends 400 Bad Request and terminates the worker, plus a regression test in httpd_SUITE for the segmented-write case.

Reproduction Steps

1. Script: bundle/repro/reproduction_steps.sh (self-contained; run twice consecutively — both runs must exit 0).
2. What the script does:
   • Resolves the prepared project cache (bundle/project_cache_context.json); with no cached repo present it clones/fetches OTP fix commit a3adf63078438c86527d704e23282b7721d8ca12 (depth 2) from https://github.com/erlang/otp.git into bundle/artifacts/otp.
   • Builds the real Erlang/OTP from source at the vulnerable commit e9f49f57cef6e38fd13c4b0cee1eb5509ef471e8 (parent of the fix; the top-level make tolerates the wx-disabled debugger failure, then make local_setup + targeted lib/stdlib/lib/inets builds complete the system) and verifies the vulnerable checkout lacks the fix hunk (records the bare catch at line 241 in evidence/vuln_bare_catch.txt).
   • For each of two clean vulnerable attempts: starts a fresh erl node running the real inets httpd on an ephemeral port with default configuration (keep_alive_timeout 150 s and minimum_bytes_per_second false left at their defaults on purpose; max_clients set to its documented default of 150 — httpd_conf only persists the key when the user supplies it, and the manager's handle_new_connection/4 looks it up without a default, so an unset key means no bound at all), plus a 1 Hz server-side census of httpd_request_handler processes. Then attack_client.py: (a) healthchecks with GET (Connection: close), (b) opens a POST with Transfer-Encoding: chunked, sends headers in one TCP write, waits 0.3 s, sends ZZZ\r\n as a separate write, and holds the socket open with no further bytes for 165 s (beyond the 150 s default keep-alive timeout), (c) sends a legit request mid-park (server still appears healthy), (d) opens a 300-connection wave of identical parked requests, waits until the server-side census confirms the pool is actually full (>= 150 parked handlers) before probing (this removes the accept-backlog race where a probe fired while the pool was still filling could be served 200), then shows fresh legitimate requests are denied (503 Service Unavailable, "heavy load"), still denied after a 25 s wait, (e) disconnects the attacker and shows the server recovers (200, census back to 0).
   • Checks out the fix commit, rebuilds lib/inets in the same tree, verifies the fix hunk is present (line 287 recorded in evidence/fix_hunk.txt), and runs two clean fixed attempts with the same attack: the bad chunk-size line must produce 400 Bad Request + server close on the parked socket, census back to 0, and legit requests still served 200 during the full exhaustion wave.
   • Evaluates every attempt against the criteria above (evidence/summary.json, pass must be true), writes runtime_manifest.json, and exits 0 = confirmed / 1 = not reproduced.
3. Expected evidence of reproduction (all produced by the script):
   • evidence/summary.json with pass: true and every per-attempt check true for two vulnerable and two fixed attempts;
   • evidence/vulnerable_attempt{1,2}/census.log: PATH vsn=9.3.2.6 with the inets beams loaded from the build tree, then CENSUS lines showing one parked handler for the whole 165 s window and 150 parked handlers during the wave;
   • evidence/vulnerable_attempt{1,2}/result.json: parked_socket_status: "timeout", parked_socket_recv: "", legit_after_exhaustion → HTTP/1.1 503 Service Unavailable, exhausted_recheck → still 503, after_close_legit → 200;
   • evidence/fixed_attempt{1,2}/result.json: parked_socket_recv starting with HTTP/1.1 400 Bad Request, parked_socket_status: "closed", census 0, legit 200 during the wave.

Evidence

• Environment: Linux x86_64, 4 cores; OTP built from source at bundle/artifacts/otp (fallback location — the prepared project cache contained no repo); vulnerable checkout e9f49f57cef6e38fd13c4b0cee1eb5509ef471e8, fixed checkout a3adf63078438c86527d704e23282b7721d8ca12, both verified by hunk inspection before their respective attempts.
• Primary logs and artifacts (all under bundle/):
  • bundle/logs/reproduction_steps.log — full transcript of the final passing run (run 2); bundle/logs/reproduction_steps_run1.log — the first consecutive passing run. Both end with RESULT: CVE-2026-69664 CONFIRMED on vulnerable build; fixed build fails closed.
  • bundle/repro/evidence/summary.json — machine-readable pass/fail per attempt and per criterion (pass: true, 4/4 attempts pass).
  • bundle/repro/evidence/vulnerable_attempt{1,2}/census.log — server-side process census, 1 Hz, 196 samples per attempt (PATH line + CENSUS lines; final entry after attacker disconnect shows count 0).
  • bundle/repro/evidence/vulnerable_attempt{1,2}/result.json, client_output.log — client-side observations of each phase.
  • bundle/repro/evidence/fixed_attempt{1,2}/... — same for the fixed build.
  • bundle/repro/evidence/vuln_bare_catch.txt (241: PROCESSED = (catch Module:Function([Data | Args])),), fix_hunk.txt (287: catch throw:{error, Error} when Module =:= http_chunk ->) — source-line proof that the vulnerable tree has the bare catch and the fixed tree has the corrected clause.
  • bundle/repro/runtime_manifest.json — runtime evidence manifest with per-artifact SHA-256 (all verified) and target identity git:https://github.com/erlang/otp@e9f49f57cef6e38fd13c4b0cee1eb5509ef471e8 (digest fac886b1b27ab179e45c1c7bf166b06ff9e1f3800dd1334f5f510e6a5cf67449).
• Key excerpts (from the final run's result.json files):
  • Vulnerable, parked worker census (both attempts): CENSUS ... 1 <0.NNN.0>:[{message_queue_len,0},{status,waiting}] at t=3/45/95/162 s — the same pid for the entire 165 s window; parked_socket_status: "timeout", parked_socket_recv: "".
  • Vulnerable, exhaustion: parked=300/300; pool_full=True (census=150 ...); legit_after_exhaustion → HTTP/1.1 503 Service Unavailable (heavy load); exhausted_recheck after 25 s → still HTTP/1.1 503 Service Unavailable, census 150; after_close_legit → HTTP/1.1 200 OK, census 0.
  • Fixed: parked_socket_recv = HTTP/1.1 400 Bad Request ..., parked_socket_status: "closed", census count 0, and legit_after_exhaustion → HTTP/1.1 200 OK during the same wave.
• Note on version labels: the fixed checkout still reports vsn=9.3.2.6 in its PATH line because the maintenance fix commit does not bump the OTP/inets version file; the authoritative discriminators between the two builds are the recorded fix-hunk lines (241 bare catch vs 287 catch throw:{error, Error}) and the behavioral divergence (indefinite park + 503 exhaustion vs immediate 400 + close + no denial).

Recommendations / Next Steps

• Upgrade guidance: upgrade to OTP 27.3.4.17 / 28.5.0.6 / 29.0.6 (inets 9.3.2.7 / 9.6.2.3 / 9.7.2) or later, which contain the catch throw:{error, Error} fix.
• Mitigations for interim: enable minimum_bytes_per_second in the httpd config so slow/stalled body receives are reaped; reduce exposure of inets httpd to untrusted networks. Be aware that leaving max_clients unset does not fall back to the documented default of 150 — httpd_conf only stores the value when the user supplies it, so an unset value effectively disables the connection cap (an even easier unbounded DoS); explicitly set it, ideally below 150.
• Suggested fix approach: the merged fix wraps the decoder continuation call so chunk-decode throws are converted into a proper 400 Bad Request response and handler termination; keep that structure for every continuation invoked from handle_info.
• Testing recommendations: the fix commit adds an httpd_SUITE case (invalid chunk size in a separate write). Keep regression coverage for the segmented-write case specifically — the single-write case was never vulnerable (handle_body/3 already had a proper try/catch), so a test that coalesces headers and body will not catch this class of bug. Consider also auditing other handle_info continuation consumers for bare catch patterns, asserting that a request timeout is always armed while a partially-received request is outstanding, and giving handle_new_connection/4's max_clients lookup the documented default.

Additional Notes

• Idempotency: reproduction_steps.sh is safe to re-run; it reuses the in-tree build under bundle/artifacts/otp, re-checks out each commit (git checkout -f), and incrementally rebuilds only the changed inets modules. Two consecutive full runs were executed in this session and both passed (exit 0, summary.json pass: true); transcripts: bundle/logs/reproduction_steps_run1.log and bundle/logs/reproduction_steps_run2.log.
• Negative/scope controls included in the proof:
  • fixed-commit build fails closed on the exact same segmented input (400 + close, worker reclaimed, no denial of service) — confirms the fix, not an environmental artifact;
  • the single-write variant (headers + ZZZ\r\n in one TCP write) returns 400 even on the vulnerable build, matching the advisory's note that the handle_body/3 path was never vulnerable (verified during development).
• Deterministic exhaustion probe: the attack client polls the server-side census until the pool is observed full (>= 150 handlers) before firing the post-exhaustion legitimate request; an earlier revision with a fixed 2-second sleep could, under scheduling pressure, fire the probe while the accept backlog was still draining and observe a misleading 200.
• Limitations: The DoS demonstration binds max_clients at its documented default (150); deployments that raised it need proportionally more parked connections, and deployments that left it unset are unbounded (see Recommendations). The census samples at 1 Hz from inside the Erlang node, so a handler that lived for only a fraction of a second could in principle be missed — not an issue here since the parked handler is verified alive across the whole 165 s observation window with the same pid. Background orchestration note: the full script takes ~10 minutes; execution environments with per-command time limits must run it detached (e.g. setsid nohup ... &).