CVE-2026-69664: Erlang OTP

httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

CVSS 8.7 HighEPSS 0.0095 · 61st percentile

Published by the CVE Program (CNA: EEF) at 1 Sept 2026, 14:59 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Erlang	OTP Package name: otp pkg:software-id/erlang.org/otp	affected 18.1.4 to before * otp Other versions: unaffected
Erlang	OTP Package name: inets pkg:otp/inets	affected 6.0.3 to before * otp Other versions: unaffected
Erlang	OTP Package name: erlang/otp https://github.com pkg:github/erlang/otp	affected 77acb473d8f056f6f534395f131c6e45693797f0 to before * git Other versions: unaffected

Identifiers

CVE-2026-69664

CNA

EEF

Weakness (CWE)

CWE-772

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.7	High	4.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	CNA (EEF)

CISA KEV Not listed.
EPSS 0.0095, the 61st percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 1 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

github.com/erlang/otp/security/advisories/GHSA-mr35-8h7w-w3gq relatedvendor-advisory
cna.erlef.org/cves/CVE-2026-69664.html related
osv.dev/vulnerability/EEF-CVE-2026-69664 related
www.erlang.org/doc/system/versions.html#order-of-versions version-scheme
github.com/erlang/otp/commit/77acb473d8f056f6f534395f131c6e45693797f0 related
github.com/erlang/otp/commit/a3adf63078438c86527d704e23282b7721d8ca12 patch
github.com/erlang/otp/commit/df1a9ca4666e2fdfc44886bfaae76de086d803f6 patch
github.com/erlang/otp/commit/bd4e74348c6be8a49f060da6fd48d43f3a960292 patch

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.