CVE-2026-55951

Executive Summary

CVE-2026-55951 is a denial-of-service vulnerability in the Erlang/OTP httpc HTTP client, affecting OTP versions 17.0 through 27.3.4.17, 28.0 through 28.5.0.6, and 29.0 through 29.0.6. The httpc client fails to enforce a limit on the total size of response headers received from a server; the max_header_size option defaults to nolimit, and response headers are accumulated into a list before any length check occurs. A malicious or compromised HTTP server can send an arbitrarily large number of headers (or headers with very large values), causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. The proof-of-concept described in the NVD entry demonstrates that 100,000 headers of roughly 4,000 bytes each cause the client VM to allocate over 13 GB of memory in under 30 seconds.

Any application using httpc:request/4,5 to connect to untrusted servers is affected. The vulnerability requires no authentication—any server the client connects to (including via a redirect or man-in-the-middle) can trigger memory exhaustion. As of this report, no public patch is available and no patch evidence has been identified from any tracked source.

Technical Analysis

The vulnerability is rooted in two design decisions within the Erlang/OTP httpc HTTP client module:

1. Default max_header_size is nolimit: The httpc client exposes a configuration option max_header_size that, by default, is set to nolimit. This means there is no upper bound on the cumulative size of HTTP response headers that the client will accept.

2. Length check occurs after full header accumulation: The httpc_response:parse_headers/6 function accumulates every header received into a list. The length check (which would trigger the max_header_size limit) only runs after the terminating CRLF CRLF sequence is received. Critically, this means that a server can stream headers indefinitely—or until memory exhaustion—and the check will never fire because the terminating sequence is never sent until the attacker decides to send it (or never sends it at all).

The attack mechanism is fundamentally a resource exhaustion flaw. Because the client buffers all headers in memory without any incremental size accounting, the data structure grows linearly with the amount of data sent by the server. The BEAM VM's memory allocator will continue to allocate heap and binary storage for the accumulated headers until the operating system-level memory limit is reached, at which point the VM either crashes or the system becomes unresponsive.

The affected inets versions are:

• inets 5.10 to before 9.3.2.7
• inets 9.4 to before 9.6.2.3
• inets 9.7 to before 9.7.2

Whether OTP versions before 17.0 (inets before 5.10) are affected is unknown per the NVD description. This creates uncertainty for organizations running legacy Erlang deployments.

The attack surface is broad: any Erlang service that uses httpc:request/4,5 to fetch data from an external or untrusted HTTP server is vulnerable. This includes:

• OAuth token validation flows where the client fetches from an identity provider
• Webhook integrations
• API gateway components
• Microservices fetching configuration from remote endpoints
• Service mesh components

No authentication is required to exploit the flaw. The attack can be delivered via a direct connection to a malicious server, through a redirect (where a trusted server redirects the client to an attacker-controlled endpoint), or via a man-in-the-middle position that can modify HTTP responses in transit.

Exploitation Scenarios

Prerequisites:

• A target application using Erlang/OTP httpc:request/4,5 to connect to reachable HTTP servers
• The target application must not disable httpc or use a hard-coded max_header_size configuration

Attack Chain:

1. Reconnaissance and Target Identification: The attacker identifies Erlang-based applications that use the httpc client to fetch remote resources. This can be done by fingerprinting BEAM VM services, examining application banners, or identifying common Erlang frameworks (e.g., Cowboy-based web applications that incorporate httpc for outbound calls). Shodan queries for Erlang httpc, inets/5., or BEAM VM can surface potentially affected services.

2. Triggering the Vulnerability: The attacker must position themselves as the HTTP server the client connects to. This can be achieved by:

   • Direct hosting: Hosting a malicious HTTP server at an endpoint the client is known to contact (e.g., a URL endpoint embedded in configuration).
   • Redirect poisoning: Compromising or controlling a server that the client trusts, and having that server issue a redirect (HTTP 3xx) to an attacker-controlled IP/hostname that serves the malicious response.
   • Man-in-the-middle: Intercepting and modifying HTTP responses in transit (e.g., on an unencrypted connection, or via TLS interception if the attacker has network position).
   • DNS poisoning: Redirecting the client's DNS resolution to point a legitimate hostname to an attacker-controlled server.

3. Payload Delivery: The attacker's server sends an HTTP response with a valid status line, followed by an arbitrarily large number of HTTP headers. The proof-of-concept described used 100,000 headers of ~4,000 bytes each, totaling ~400 MB of header data, which caused the client VM to allocate over 13 GB of memory. The key detail is that the httpc_response:parse_headers/6 function buffers all headers in a list before the max_header_size check fires—and the check only fires after CRLF CRLF is received. The attacker can stream headers indefinitely without ever sending the terminating sequence, or can send the terminating sequence only after exhausting memory.

4. Post-Exploitation Impact: Once memory exhaustion occurs:

   • The BEAM VM process crashes (likely with an out-of-memory error) or the operating system kills the process via OOM killer.
   • If the affected process is an Erlang node running multiple services (common in Erlang's supervision tree model), the entire node may be taken down.
   • Downtime occurs until the process is restarted and services recover.
   • Repeated exploitation can cause persistent availability issues, effectively creating a denial of service for the application and any other services running on the same VM.

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description's reference to a proof-of-concept server.

Impact Assessment

CVSS Score: N/A — no CVSS vector has been assigned by the vendor or NVD at the time of this report. The lack of scoring complicates automated risk prioritization in security tools that rely on CVSS.

CWE: CWE-770 (Allocation of Resources Without Limits or Throttling) — correctly identifies the root cause.

Business Impact:

• Availability (primary): The vulnerability is a denial-of-service vector. An attacker who can influence an HTTP response to a vulnerable httpc client can crash the entire BEAM VM, taking down all services running in that VM. For organizations running multiple Erlang services on a single node (common in microservice architectures), the blast radius extends beyond the directly affected service.
• Integrity impact: None directly, but an attacker who can exhaust memory on a shared VM could cause other services to fail in ways that might corrupt in-memory state (e.g., if the OOM killer terminates a critical process while another process is mid-transaction).
• Confidentiality impact: None directly. However, memory exhaustion may cause the BEAM VM to write swap files, potentially exposing sensitive data to disk-based forensics.

Blast Radius:

• Directly affected: Any Erlang/OTP application using httpc:request/4,5 to connect to untrusted servers.
• Indirectly affected: Services sharing the same BEAM VM as the vulnerable process (memory exhaustion is VM-wide).
• Infrastructure: Client-side exhaustion does not impact the attacker's server infrastructure; the attacker only needs a modest amount of outbound bandwidth to send the header stream.

CISA KEV: NO — not on the Known Exploited Vulnerabilities catalog at the time of this report.

EPSS: Not yet scored by FIRST.org — no probabilistic likelihood score is available. This makes it difficult to prioritize patching based on predicted severity.

Detection Guidance

Sigma Rule

title: Erlang httpc Outbound Memory Exhaustion via Excessive HTTP Headers
id: 2f8dcc3e-7b21-4d66-9f44-9d1b3f69e1d4
status: experimental
description: Detects anomalous outbound HTTP traffic from Erlang-based applications where the number or size of response headers exceeds normal thresholds, indicating possible exploitation of CVE-2026-55951.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55951
tags:
    - attack.t1499.001
author: vartersit.com SOC
date: 2026/06/10
logsource:
    category: network_connection
    product: mitre
detection:
    selection:
        EventID: 3  # Network connection
        DestinationPort: 80
    filter_https:
        DestinationPort: 443
    condition: selection and not filter_https
    timeframe: 30s
    threshold: 500  # Number of connection events in 30 seconds
fields:
    - SourceIp
    - DestinationIp
    - DestinationPort
    - User
level: high
falsepositives:
    - Applications making legitimate bulk HTTP requests to servers with extremely large response headers
    - Misconfigured legacy applications

YARA Rule

rule CVE_2026_55951_Erlang_httpc_Header_Flood
{
    meta:
        author = "vartersit.com SOC"
        description = "Detects packet patterns associated with CVE-2026-55951 - Erlang httpc excessive response header memory exhaustion"
        date = "2026-06-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55951"
        cwe = "CWE-770"
        severity = "high"
    strings:
        // Look for HTTP response headers with unusually long values or many headers
        // This matches multiple HTTP/1.1 header lines in sequence without size limits
        $http_hdr = "HTTP/1.1" ascii
        $hdr_sep = "\r\n" ascii
        $header_field = /^[A-Za-z-]+:\s*/
        
        // Combined size heuristic: if more than 50 header fields are seen in a single response
        $count_check = /(?:[A-Za-z-]+:\s*[^\r\n]+\r\n){50,}/ ascii nocase
        
        // Extremely large header value pattern
        $large_value = /[A-Za-z-]+:\s*[^\r\n]{4000,}/ ascii
    condition:
        uint16(0) == 0x4854 and  // "HT" - HTTP
        $http_hdr and
        (any of ($header_field*)) and
        ($count_check or $large_value)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"ET EXPLOIT Erlang httpc CVE-2026-55951 Header Flood Attempt"; flow:established,to_client; content:"HTTP/1.1"; nocase; pcre:"/(?:[A-Za-z-]+:\s*[^\r\n]+\r\n){100,}/R"; threshold:type both, track by_src, count 1, seconds 60; classtype:attempted-dos; sid:66255951; rev:1; metadata:created_at 2026_06_10, updated_at 2026_06_10, attack_target client_endpoint, deployment perimeter, signature_severity Major, former_category EXPLOIT)

Note: This rule detects a single HTTP response containing ≥100 header lines. It is designed to catch the proof-of-concept behavior of sending headers in bulk. In practice, the threshold may need tuning based on legitimate traffic patterns.

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where event.category == "network" and network.direction == "outbound" and destination.port in (80, 443) and process.name == "beam.smp"]
  [network where event.category == "network" and network.direction == "outbound" and destination.port in (80, 443) and process.name == "beam.smp"]
  | rename source.ip as source_ip
  | eval header_count = 0

Alternative EQL (if application-level logging of HTTP responses is available):

any where process.name == "beam.smp" and event.dataset == "http" and event.action == "response" and http.response.headers.count > 100

Rate-based detection (if header count is not retrievable):

sequence by source.ip
  [any where event.category == "network" and network.transport == "tcp" and destination.port == 80]
  with maxspan=30s
  | stats count(network.bytes) as bytes_sent by source.ip
  | where bytes_sent > 5000000

Splunk SPL Query

index=proxy OR index=network
| where sourcetype="pan:traffic" OR sourcetype="cisco:asa"
| search app=ssl OR app=http
| search src_ip=* dest_port=80 OR dest_port=443
| bin _time span=30s
| stats count as conn_count, sum(bytes_out) as total_bytes_out by _time, src_ip, dest_ip
| where conn_count > 100 OR total_bytes_out > 5000000
| eval is_exploit = if(conn_count > 500, "High Confidence", "Medium Confidence")
| table _time, src_ip, dest_ip, conn_count, total_bytes_out, is_exploit
| sort - _time

Wazuh OSSEC Rule

<group name="erlang_httpc_dos,">
    <rule id="643368" level="12">
        <if_sid>100001</if_sid>
        <match>beam\.smp</match>
        <match>out of memory</match>
        <description>CVE-2026-55951: Erlang BEAM VM out-of-memory - possible httpc header exhaustion attack</description>
        <group>attack.dos,</group>
        <mitre>
            <id>T1499.001</id>
        </mitre>
    </rule>
</group>

Note: The above Wazuh rule relies on the BEAM VM logging an out-of-memory error. For active detection, an additional rule that monitors connection rate from the Erlang service:

<group name="erlang_httpc_dos_rate,">
    <rule id="643369" level="10" frequency="30" timeframe="60">
        <if_sid>100001</if_sid>
        <match>beam\.smp</match>
        <match>httpc</match>
        <description>High outbound connection rate from Erlang httpc client - possible CVE-2026-55951 exploitation</description>
        <group>attack.dos,</group>
        <mitre>
            <id>T1499.001</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch status: UNPATCHED — Patch confidence is 0/4. No vendor advisory, patch commit, or fixed version release has been identified from any tracked source at the time of this report. The NVD description explicitly lists affected versions but provides no fixed versions.

Immediate mitigations (no patch available):

1. Set max_header_size explicitly: In any code that invokes httpc:request/4,5 or httpc:request/5, explicitly configure the max_header_size option to a reasonable limit (e.g., the size of the largest legitimate header set expected). The default is nolimit, which is the vulnerable configuration. Note: even with this set, the length check only fires after CRLF CRLF is received, so an attacker who never sends the terminating sequence may still cause memory growth up to the configured limit plus one header. This mitigation reduces the blast radius but does not fully eliminate the risk.

2. Restrict outbound HTTP access: Use egress firewall rules to restrict which hosts the Erlang service can connect to. If the application only needs to reach a small set of known servers, white-list those IPs/hostnames. This prevents connections to arbitrary attacker-controlled endpoints.

3. Use a reverse proxy or HTTP gateway: Route all outbound HTTP requests through a hardened proxy or gateway that enforces header limits at the network layer (e.g., nginx with large_client_header_buffers set, or HAProxy with http-response set-header limits). The proxy can reject or truncate oversized responses before the data reaches the Erlang client.

4. Implement timeouts: Set a socket timeout on httpc requests to abort connections that send data too slowly. While this doesn't cap the total header size, it limits the duration of an attack.

5. Memory monitoring: Monitor BEAM VM memory usage and set up alerts when memory exceeds a threshold. Implement automatic restart of the VM if memory usage exceeds a critical level, but note that this is a reactive measure.

6. Move to an alternative HTTP client: If the application architecture allows, replace httpc:request/4,5 calls with a patched alternative HTTP client library (e.g., hackney or gun) that enforces header limits by default.

Patch/upgrade steps:

• Monitor the Erlang/OTP release announcements for a patched version. The vendor has not yet released a fix. When a fixed OTP version becomes available, upgrade to the first patched release in your supported line (expected to be 27.3.4.17+, 28.5.0.6+, or 29.0.6+ lineage).
• Check your distribution's package manager for backported patches (e.g., Debian/Ubuntu security repositories may provide a patched erlang package).
• Test the upgrade in a staging environment before production deployment.

Long-term hardening:

• Adopt an Erlang/OTP version that includes the fix. The vulnerability is confirmed on OTP 17.0 through 27.3.4.17, 28.0 through 28.5.0.6, and 29.0 through 29.0.6.
• For legacy systems running OTP before 17.0 where the vulnerability status is unknown, assume the worst and apply the mitigations above.
• Review all Erlang application code for uses of httpc:request/4,5 and audit whether each call targets trusted servers. Any call that may reach an untrusted endpoint (directly or via redirect) should be hardened.
• Implement regular vulnerability scanning of the Erlang application's dependency manifests.
• Consider running vulnerable Erlang services in isolated containers with memory limits (e.g., Docker --memory flag) so that a single BEAM VM crash does not take down the host or other services.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-55951 — The primary source for this report; contains the full description and affected version lists.

2. CWE-770: https://cwe.mitre.org/data/definitions/770.html — Allocation of Resources Without Limits or Throttling, the weakness class for this vulnerability.

3. Erlang/OTP Security Advisories: https://www.erlang.org/patches/security — The official Erlang/OTP security bulletin page; check here for the forthcoming patch advisory.

4. Erlang HTTP Client Documentation: https://www.erlang.org/doc/apps/inets/httpc.html — Official documentation for the httpc module, including the max_header_size option and its default behavior. This confirms the nolimit default.

5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CISA KEV currently lists this CVE as NOT included (NO). This should be re-checked periodically, as KEV inclusion can change.

Threat Actor Activity: No active exploitation campaigns have been publicly reported as of this report. The NVD description mentions a proof-of-concept server but does not indicate real-world exploitation. Given the availability of a PoC and the ease of exploitation (no authentication, simple HTTP server setup), exploitation in the wild is considered likely in the near term. Enterprise security teams should treat this as an actively exploitable vulnerability and prioritize the mitigations outlined above, even without confirmed malicious activity.