CVE-2026-69664
Erlang inets httpd bug allows unauthenticated requests to exhaust worker threads (DoS).
Is CVE-2026-69664 being exploited?
Not confirmed. CVE-2026-69664 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.69% probability of exploitation in the next 30 days.
How severe is CVE-2026-69664?
CVE-2026-69664 is rated High with a CVSS score of 8.7. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-69664?
Yes. A fix has been recorded for CVE-2026-69664. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-69664 affect?
CVE-2026-69664 affects Erlang/OTP 18.1.4 -> < 27.3.4.17, Erlang/OTP 28.0 -> < 28.5.0.6, Erlang/OTP 29.0 -> < 29.0.6, inets 6.0.3 -> < 9.3.2.7; 9.4 -> < 9.6.2.3; 9.7 -> < 9.7.2. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-69664?
Upgrade OTP/inets to fixed releases and/or enable request timeouts and minimum_bytes_per_second.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Unauthenticated attacker can send malformed chunked requests to occupy all httpd workers, causing denial of service; default config affected.
Immediate action required
- affected>= 18.1.4 and < 27.3.4.17
- affected>= 28.0 and < 28.5.0.6
- affected>= 29.0 and < 29.0.6
- affected>= 6.0.3 and < 9.3.2.7
- affected>= 9.4 and < 9.6.2.3
- affected>= 9.7 and < 9.7.2
- affected>= 77acb473d8f056f6f534395f131c6e45693797f0 and < *
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.