CVE-2026-74835 - Vulnerability Details

- inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

Description

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Published: 2026-09-01

Score: 8.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Erlang OTP inets HTTP server httpd ignores the configured max_body_size limitation when receiving a chunked request body. This flaw allows a request to grow arbitrarily large, potentially exhausting available server memory and causing the application to hang, crash, or become unresponsive. The weakness is classified as unbounded resource allocation (CWE‑770) and also marked by CWE‑1284.

Affected Systems

The issue affects Erlang OTP releases from 17.0 up through OTP 27.3.4.16, OTP 28.0 up through OTP 28.5.0.5, and OTP 29.0 up through OTP 29.0.5, along with corresponding inets HTTP server versions 5.10 to 9.7.1. Releases OTP 27.3.4.17, 28.5.0.6, and 29.0.6 or later contain the fix. The impact applies to any system running those vulnerable OTP/inets combinations.

Risk and Exploitability

The CVSS score of 8.7 indicates a high‑severity denial‑of‑service risk. The EPSS score of 0.00328 (less than 1%) indicates a very low likelihood of exploitation, though not zero. The weakness is remotely exploitable through the HTTP protocol, and no authentication is required—this is inferred from the nature of a public HTTP service that accepts unbounded request bodies. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported yet, but the high impact score warrants prompt remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Erlang

OTP

unaffected

Version	Status	Constraints
`0`	unknown	< 17.0
`17.0`	affected	< 27.3.4.17
`28.0`	affected	< 28.5.0.6
`29.0`	affected	< 29.0.6

Erlang

OTP

unaffected

Version	Status	Constraints
`0`	unknown	< 5.10
`5.10`	affected	< 9.3.2.7
`9.4`	affected	< 9.6.2.3
`9.7`	affected	< 9.7.2

Erlang

OTP

unaffected

Version	Status	Constraints
`84adefa331c4159d432d22840663c38f155cd4c1`	affected	< *

No data.

Vendor Product Confidence Versions

Erlang

Erlang/otp

95%

Version	Status	Scheme	Platform
`[17.0,27.3.4.17)`	affected	generic	—
`[28.0,28.5.0.6)`	affected	generic	—
`[29.0,29.0.6)`	affected	generic	—
`[5.10,9.3.2.7)`	affected	generic	—
`[9.4,9.6.2.3)`	affected	generic	—
`[9.7,9.7.2)`	affected	generic	—
`[84adefa331c4159d432d22840663c38f155cd4c1,*]`	affected	code_commit	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[17.0,27.3.4.17)`	affected	generic	—
`[28.0,28.5.0.6)`	affected	generic	—
`[29.0,29.0.6)`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[5.10,9.3.2.7)`	affected	generic	—
`[9.4,9.6.2.3)`	affected	generic	—
`[9.7,9.7.2)`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[84adefa331c4159d432d22840663c38f155cd4c1,*]`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Erlang OTP to a release that includes the fix (OTP 27.3.4.17, 28.5.0.6, or 29.0.6 and later) and use the corresponding inets version 9.7.2 or newer.
Verify that the inets configuration parameter max_body_size is set to an appropriate limit and restart the httpd server to confirm enforcement.
Apply a front‑end proxy or firewall that limits request body sizes to provide temporary protection while patching if an immediate upgrade is not feasible.

Generated by OpenCVE AI on September 3, 2026 at 14:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00328.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-74835.html
https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86
https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011
https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7
https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5
https://nvd.nist.gov/vuln/detail/CVE-2026-74835
https://osv.dev/vulnerability/EEF-CVE-2026-74835
https://www.cve.org/CVERecord?id=CVE-2026-74835

History

Thu, 03 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://nvd.nist.gov/vuln/detail/CVE-2026-74835 https://www.cve.org/CVERecord?id=CVE-2026-74835
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Tue, 01 Sep 2026 22:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang/otp Erlang otp
Vendors & Products		Erlang erlang/otp Erlang otp
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 01 Sep 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Title		inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
First Time appeared		Erlang Erlang erlang\/otp
Weaknesses		CWE-770
CPEs		cpe:2.3:a:erlang:erlang\/otp::::::::
Vendors & Products		Erlang Erlang erlang\/otp
References		https://cna.erlef.org/cves/CVE-2026-74835.html https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86 https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011 https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7 https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5 https://osv.dev/vulnerability/EEF-CVE-2026-74835
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-09-01T14:45:16.377Z

Updated: 2026-09-08T01:10:27.102Z

Reserved: 2026-08-17T12:30:01.524Z

Link: CVE-2026-74835

Vulnrichment

Updated: 2026-09-01T15:57:19.974Z

NVD

Status : Deferred

Published: 2026-09-01T15:17:25.730

Modified: 2026-09-08T01:17:54.277

Link: CVE-2026-74835

Redhat

Severity : Important

Publid Date: 2026-09-01T14:45:16Z

Links: CVE-2026-74835 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-03T14:30:05Z

Weaknesses

CWE-1284
Improper Validation of Specified Quantity in Input
CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object