Unverified File Handles can Cause Excessive Use of System Resources

Versions reported by the vendor

Affected version ranges reported by the assigning authority (EEF). Independent of NVD's CPE analysis and usually ahead of it.

• Erlang OTP

  • 3.0.1 and lateraffected · otpfixed in 5.3.3, 5.2.11.3, 5.1.4.12
  • 17.0 and lateraffected · otpfixed in 28.0.3, 27.3.4.3, 26.2.5.15
  • 07b8f441ca711f9812fad9e9115bab3c3aa92f79 and lateraffected · gitfixed in 4e3bf86777ab3db7220c11d8ddabf15970ddd10a, f09e0201ff701993dc24a08f15e524daf72db42f

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-89422TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension
  37Monitor
• CVE-2026-74835inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
  34Monitor
• CVE-2026-71380httpd applies no timeout while receiving a request body, parking a worker on a stalled client
  34Monitor
• CVE-2026-70399httpd does not enforce the documented default max_clients connection limit
  34Monitor
• CVE-2026-69664httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
  34Monitor
• CVE-2026-73812inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
  33Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.