Vulnerability · Published Sep 1, 2026 · Assigned by EEF
CVE-2026-55951httpc memory exhaustion via unbounded response header accumulation
High 8.2
In plain English
A high-severity resource allocation without limits in OTP from Erlang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received). A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds. Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | erlang | no fix listed | DEBIAN-CVE-2026-55951 |
| Debian:13 | erlang | 1:27.3.4.1+dfsg-1+deb13u4 | DEBIAN-CVE-2026-55951 |
| Debian:14 | erlang | 1:29.0.6+dfsg-1 | DEBIAN-CVE-2026-55951 |
| Ubuntu:22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.7 | UBUNTU-CVE-2026-55951 |
| Ubuntu:22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.7 | USN-8827-1 |
| Ubuntu:24.04:LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.7 | USN-8827-1 |
| Ubuntu:24.04:LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.7 | UBUNTU-CVE-2026-55951 |
| Ubuntu:26.04:LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.1 | USN-8827-1 |
| Ubuntu:26.04:LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.1 | UBUNTU-CVE-2026-55951 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/erlang/otp/security/advisories/GHSA-f9fw-mg7q-4g3x vendor-advisory
- https://cna.erlef.org/cves/CVE-2026-55951.html related
- https://osv.dev/vulnerability/EEF-CVE-2026-55951 related
- https://www.erlang.org/doc/system/versions.html#order-of-versions x_version-scheme
- https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d patch
- https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa patch