The Erlang/OTP project reports:
OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following
issues, most of them in the inets httpd and httpc
implementations:
- CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation.
- CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer Conversion.
- CVE-2026-66357: HTTP Request Smuggling via obs-fold Header Continuation in httpd.
- CVE-2026-66835: Possible directory protection bypass in Erlang-OTP inets httpd.
- CVE-2026-69664: Denial of Service via Malformed Chunk Size in httpd.
- CVE-2026-70399: Denial of Service via Unenforced Default max_clients Limit in httpd.
- CVE-2026-70405: snmp: Denial-of-Service enabled by Unbounded Integer Conversion.
- CVE-2026-70409: eldap: Denial-of-Service enabled by Unbounded Integer Conversion.
- CVE-2026-71380: Denial of Service via Body-Read Timeout Gap in httpd (Slowloris Variant).
- CVE-2026-71562: inets: Denial-of-Service enabled by Unbounded Integer Conversion.
- CVE-2026-73270: Authentication Bypass via Case-Insensitive Filesystem Path Matching in httpd mod_auth.
- CVE-2026-73276: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping in httpd.
- CVE-2026-73812: HTTP Request Smuggling via Transfer-Encoding and Content-Length in httpd.
- CVE-2026-74835: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception in httpd.
- CVE-2026-74994: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth (dets/mnesia backends).