CVE-2026-74835 inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
Attackers can cause memory exhaustion in the Erlang OTP inets HTTP server by sending chunked requests that bypass configured body size limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74835?
CVE-2026-74835 is a high-severity denial of service vulnerability in Erlang OTP, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Weakness: CWE-770
Which versions are affected by CVE-2026-74835?
How do I fix CVE-2026-74835?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74835 being exploited?
There is no known exploitation of CVE-2026-74835 in the wild and no public exploit code.
Sources
Also known as AZL-98493, DEBIAN-CVE-2026-74835, EEF-CVE-2026-74835, GHSA-8qrh-x566-5xv5, UBUNTU-CVE-2026-74835.