CVE-2026-70399
Description
A flaw was found in inets. An unauthenticated remote attacker can exploit a resource allocation vulnerability in the Erlang/OTP inets httpd component. This flaw allows the attacker to cause a denial of service by opening and holding open a large number of connections. The server fails to enforce its documented default connection limit, leading to the exhaustion of server resources such as processes, memory, and file descriptors, making the service unavailable.
Statement
Red Hat has evaluated this vulnerability as having an Important severity because an unauthenticated remote attacker can exhaust system memory, file descriptors, and processes, causing a complete denial of service without requiring authentication or valid HTTP requests. The issue does not warrant a Critical rating because it exclusively affects availability, with no risk of code execution or data exposure. In Red Hat environments, impact is limited to deployments actively running the embedded inets httpd service that rely on default connection parameters.
Mitigation
To mitigate this issue, explicitly configure the `max_clients` option in the Erlang/OTP inets httpd server configuration to a reasonable value. This will enforce a limit on simultaneous connections, preventing resource exhaustion. Consult the Erlang/OTP inets documentation for specific configuration instructions. A restart or reload of the affected service may be required for the changes to take effect, which could temporarily impact service availability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
