Every CVE Search/ Get API key

CVE-2026-69664

httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

8.7 HighFix available

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.95%Up 0.3 points since Sep 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Record
CVE-2026-69664
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-772
Updated
2026-11-02
EUVDEUVD-2026-69381 8.7

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Record
EUVD-2026-69381
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.7

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Record
CVE-2026-69664
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-772
Updated
2026-11-02
OSV 8.7

httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Record
CVE-2026-69664
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-772
Updated
2026-11-02
OSVDEBIAN-CVE-2026-69664 8.7

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default. This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Record
DEBIAN-CVE-2026-69664
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVEEF-CVE-2026-69664 8.7

httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Summary

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Workarounds

  • Set minimum_bytes_per_second in the httpd configuration, for example {minimum_bytes_per_second, 200}. This arms a periodic byte-rate check that terminates a connection which has stopped delivering data, reclaiming the parked worker within a few seconds. The check is disabled by default, and any positive value suffices because an affected connection delivers no further data at all.
  • Place a reverse proxy in front of httpd that validates chunked transfer encoding and rejects malformed chunk framing before it reaches httpd.
  • Restrict access to the server to trusted clients where the deployment allows it.
Record
EEF-CVE-2026-69664
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-772
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2026-4131 8.7

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).

A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.

Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.(CVE-2026-55951)

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.

uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4.(CVE-2026-59696)

httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.(CVE-2026-66357)

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.

httpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored…

Record
OESA-2026-4131
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-4132 8.7

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).

A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.

Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.(CVE-2026-55951)

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.

uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4.(CVE-2026-59696)

httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.(CVE-2026-66357)

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.

httpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored…

Record
OESA-2026-4132
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-4133 8.7

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).

A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.

Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.(CVE-2026-55951)

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.

uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4.(CVE-2026-59696)

httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.(CVE-2026-66357)

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.

httpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored…

Record
OESA-2026-4133
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVRHSA-2026:62531 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:62531
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-69664 8.7

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default. This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Record
UBUNTU-CVE-2026-69664
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-98466 No score

CVE-2026-69664 affecting package erlang for versions less than 26.2.5.21-6

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Record
AZL-98466
Updated
2026-11-05
OSVUSN-8827-1 No score

erlang vulnerabilities

It was discovered that the Erlang Port Mapper Daemon did not properly handle slow connections. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-42792)

It was discovered that Erlang incorrectly handled certain external term format data, leading to heap corruption. An attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-55737)

It was discovered that Erlang incorrectly handled invalid external term format data. An attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-54890)

It was discovered that Erlang incorrectly handled certain packet lengths, leading to a buffer overflow. A remote attacker could possibly use this issue to cause Erlang to crash or execute arbitrary code. (CVE-2026-75538)

It was discovered that the Erlang Megaco flex scanner incorrectly handled certain input, leading to a buffer overflow. A remote attacker could possibly use this issue to cause Erlang to crash or execute arbitrary code. (CVE-2026-59250)

It was discovered that Erlang TLS clients incorrectly accepted cipher suites that they had not offered. A remote attacker could possibly use this issue to intercept and modify TLS communications. (CVE-2026-55953)

It was discovered that Erlang incorrectly handled certain certificate chains. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-58227)

It was discovered that Erlang incorrectly handled certain certificate policies. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59251)

It was discovered that the Erlang HTTP server incorrectly handled certain conflicting HTTP framing headers. A remote attacker could possibly use this issue to smuggle HTTP requests. (CVE-2026-23941, CVE-2026-73812)

It was discovered that the Erlang HTTP server incorrectly handled certain malformed chunk sizes. A remote attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. (CVE-2026-69664)

It was discovered that the Erlang HTTP server did not properly limit the size of chunked request bodies. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. (CVE-2026-74835)

It was discovered that the Erlang HTTP server incorrectly handled certain equivalent request paths and differences in character case. A remote attacker could possibly use this issue to bypass authentication and gain unauthorized access. (CVE-2026-66835, CVE-2026-73270)

It was discovered that the Erlang HTTP server did not properly limit simultaneous connections. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-70399)

It was discovered that the Erlang HTTP server incorrectly handled header continuation lines. A remote attacker could possibly use this issue to smuggle HTTP requests. (CVE-2026-66357)

It was discovered that the Erlang HTTP server incorrectly handled certain malformed header names. A remote attacker could possibly use this issue to smuggle HTTP requests. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-73276)

It was discovered that the Erlang HTTP server incorrectly handled incomplete request bodies. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of…

Record
USN-8827-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
erlang
Azure Linux:3
 before 26.2.5.21-6
26.2.5.21-6
erlang
Debian:12
 All versions, plus listed versions
1:25.2.3+dfsg-11:25.2.3+dfsg-1+deb12u11:25.2.3+dfsg-1+deb12u21:25.2.3+dfsg-1+deb12u31:25.2.3+dfsg-1+deb12u4
Show 45 moreShow less
1:25.3.2.10+dfsg-11:25.3.2.10+dfsg-21:25.3.2.11+dfsg-11:25.3.2.12+dfsg-11:25.3.2.12+dfsg-21:25.3.2.12+dfsg-31:25.3.2.8+dfsg-11:26.0+dfsg-11:26.0.1+dfsg-11:26.0.2+dfsg-11:26.0~rc2+dfsg-11:26.0~rc3+dfsg-11:26.1.2+dfsg-11:26.2.1+dfsg-11:26.2.4+dfsg-11:27.0+dfsg-11:27.0.1+dfsg-11:27.0.1+dfsg-21:27.0.1+dfsg-31:27.0~rc3+dfsg-11:27.0~rc3+dfsg-21:27.0~rc3+dfsg-31:27.0~rc3+dfsg-41:27.1.2+dfsg-11:27.2+dfsg-11:27.2+dfsg-21:27.2+dfsg-3~exp11:27.2.1+dfsg-11:27.2.1+dfsg-21:27.2.2+dfsg-11:27.2.3+dfsg-11:27.2.4+dfsg-11:27.3+dfsg-11:27.3.1+dfsg-11:27.3.2+dfsg-11:27.3.3+dfsg-11:27.3.4+dfsg-11:27.3.4.1+dfsg-11:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-31:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-6
 None known
erlang
Debian:13
 before 1:27.3.4.1+dfsg-1+deb13u4, plus listed versions
1:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1+deb13u11:27.3.4.1+dfsg-1+deb13u21:27.3.4.1+dfsg-1+deb13u3
1:27.3.4.1+dfsg-1+deb13u4
erlang
Debian:14
 before 1:29.0.6+dfsg-1, plus listed versions
1:27.3.4.1+dfsg-11:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-3
Show 31 moreShow less
1:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-61:27.3.4.11+dfsg-71:27.3.4.12+dfsg-11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.8+dfsg-11:27.3.4.9+dfsg-11:28.0+dfsg-11:28.0.1+dfsg-11:28.0.2+dfsg-11:28.0.4+dfsg-11:28.1.1+dfsg-11:28.2+dfsg-11:28.3+dfsg-11:28.3.1+dfsg-11:29.0+dfsg-11:29.0+dfsg-21:29.0.1+dfsg-11:29.0.2+dfsg-11:29.0.3+dfsg-11:29.0.4+dfsg-11:29.0~rc1+dfsg-11:29.0~rc1+dfsg-21:29.0~rc2+dfsg-11:29.0~rc3+dfsg-11:29.0~rc3+dfsg-21:29.0~rc3+dfsg-31:29.0~rc3+dfsg-4
1:29.0.6+dfsg-1
erlang
openEuler:24.03-LTS-SP1
From an advisory covering 15 CVEs
 before 25.3.2.6-20.oe2403sp1
25.3.2.6-20.oe2403sp1
erlang
openEuler:24.03-LTS-SP3
From an advisory covering 15 CVEs
 before 25.3.2.6-20.oe2403sp3
25.3.2.6-20.oe2403sp3
erlang
openEuler:24.03-LTS-SP4
From an advisory covering 15 CVEs
 before 25.3.2.6-20.oe2403sp4
25.3.2.6-20.oe2403sp4
erlang27
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-asn1
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-common_test
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
Show 50 moreShow less
Affected packages
PackageAffectedFixed
erlang27-compiler
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-crypto
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-debugger
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-dialyzer
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-diameter
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-edoc
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-eldap
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-erl_interface
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-erts
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-et
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-eunit
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-examples
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-ftp
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-gdb-tools
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-inets
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-jinterface
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-kernel
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-megaco
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-mnesia
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-observer
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-odbc
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-os_mon
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-parsetools
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-public_key
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-reltool
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-runtime_tools
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-sasl
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-snmp
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-ssh
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-ssl
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-stdlib
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-syntax_tools
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-tftp
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-tools
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-wx
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang27-xmerl
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:27.3.4.17-0.1.hum1
0:27.3.4.17-0.1.hum1
erlang
Ubuntu:Pro:14.04:LTS
 before 1:16.b.3-dfsg-1ubuntu2.2+esm2, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu21:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.21:16.b.3-dfsg-1ubuntu2.2+esm1
1:16.b.3-dfsg-1ubuntu2.2+esm2
erlang
Ubuntu:Pro:16.04:LTS
 before 1:18.3-dfsg-1ubuntu3.1+esm3, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu2
Show 4 moreShow less
1:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm11:18.3-dfsg-1ubuntu3.1+esm2
1:18.3-dfsg-1ubuntu3.1+esm3
erlang
Ubuntu:Pro:18.04:LTS
 before 1:20.2.2+dfsg-1ubuntu2+esm3, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 7 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm11:20.2.2+dfsg-1ubuntu2+esm2
1:20.2.2+dfsg-1ubuntu2+esm3
erlang
Ubuntu:Pro:20.04:LTS
 before 1:22.2.7+dfsg-1ubuntu0.5+esm2, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 8 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.51:22.2.7+dfsg-1ubuntu0.5+esm1
1:22.2.7+dfsg-1ubuntu0.5+esm2
erlang
Ubuntu:22.04:LTS
 before 1:24.2.1+dfsg-1ubuntu0.7, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 8 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.51:24.2.1+dfsg-1ubuntu0.6
1:24.2.1+dfsg-1ubuntu0.7
erlang
Ubuntu:24.04:LTS
 before 1:25.3.2.8+dfsg-1ubuntu4.7, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 6 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.41:25.3.2.8+dfsg-1ubuntu4.51:25.3.2.8+dfsg-1ubuntu4.6
1:25.3.2.8+dfsg-1ubuntu4.7
erlang
Ubuntu:26.04:LTS
 before 1:27.3.4.6+dfsg-1ubuntu0.1, plus listed versions
1:27.3.4.1+dfsg-1build11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-1
1:27.3.4.6+dfsg-1ubuntu0.1
erlang
Ubuntu:Pro:14.04:LTS
From an advisory covering 19 CVEs
 before 1:16.b.3-dfsg-1ubuntu2.2+esm2, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu21:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.21:16.b.3-dfsg-1ubuntu2.2+esm1
1:16.b.3-dfsg-1ubuntu2.2+esm2
erlang
Ubuntu:Pro:16.04:LTS
From an advisory covering 19 CVEs
 before 1:18.3-dfsg-1ubuntu3.1+esm3, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu2
Show 4 moreShow less
1:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm11:18.3-dfsg-1ubuntu3.1+esm2
1:18.3-dfsg-1ubuntu3.1+esm3
erlang
Ubuntu:Pro:18.04:LTS
From an advisory covering 19 CVEs
 before 1:20.2.2+dfsg-1ubuntu2+esm3, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 7 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm11:20.2.2+dfsg-1ubuntu2+esm2
1:20.2.2+dfsg-1ubuntu2+esm3
erlang
Ubuntu:Pro:20.04:LTS
From an advisory covering 19 CVEs
 before 1:22.2.7+dfsg-1ubuntu0.5+esm2, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 8 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.51:22.2.7+dfsg-1ubuntu0.5+esm1
1:22.2.7+dfsg-1ubuntu0.5+esm2
erlang
Ubuntu:22.04:LTS
From an advisory covering 19 CVEs
 before 1:24.2.1+dfsg-1ubuntu0.7, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 8 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.51:24.2.1+dfsg-1ubuntu0.6
1:24.2.1+dfsg-1ubuntu0.7
erlang
Ubuntu:24.04:LTS
From an advisory covering 19 CVEs
 before 1:25.3.2.8+dfsg-1ubuntu4.7, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 6 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.41:25.3.2.8+dfsg-1ubuntu4.51:25.3.2.8+dfsg-1ubuntu4.6
1:25.3.2.8+dfsg-1ubuntu4.7
erlang
Ubuntu:26.04:LTS
From an advisory covering 19 CVEs
 before 1:27.3.4.6+dfsg-1ubuntu0.1, plus listed versions
1:27.3.4.1+dfsg-1build11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-1
1:27.3.4.6+dfsg-1ubuntu0.1

History

History
RecordedChangedSources
affected
factsOSV
aliases
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-69664 is a high vulnerability (CVSS 8.7) in Erlang Otp, published September 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in erlang 26.2.5.21-6.

References

Show 109 moreShow less
This page doesn't list everything

Left out here: 30 versions and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open