CVE-2026-74835
Received Received - Intake

Buffer Overflow in Erlang/OTP inets HTTP Server

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-74835
EUVD
EUVD-2026-69238

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
erlang otp From 29.0 (inc) to 29.0.6 (exc)
erlang inets From 9.7 (inc) to 9.7.2 (exc)
otp otp to 27.3.4.17 (exc)
otp otp to 28.5.0.6 (exc)
otp otp to 29.0.6 (exc)
inets inets to 9.3.2.7 (exc)
inets inets to 9.6.2.3 (exc)
inets inets to 9.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74835 is a vulnerability in the Erlang/OTP inets application's HTTP server where it fails to enforce configured body-size limits on chunked requests. This allows clients to send data exceeding the limit without immediate rejection, potentially causing memory exhaustion.

Detection Guidance

To detect this vulnerability, monitor HTTP servers running affected OTP/inets versions for excessive memory usage or crashes during chunked transfer requests. Check logs for HTTP 413 errors indicating body size violations. Use network monitoring tools like tcpdump or Wireshark to inspect HTTP traffic for unusually large chunked payloads.

Impact Analysis

This vulnerability can lead to denial-of-service attacks by allowing attackers to flood the server with excessive data, consuming memory resources and potentially crashing the service. It may also enable unauthorized data transmission if size limits are bypassed.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that exhaust server memory, potentially disrupting services handling sensitive personal or health data. Uncontrolled memory usage may lead to system instability or crashes, compromising availability requirements under these regulations.

Mitigation Strategies

Upgrade to patched versions: OTP 27.3.4.17+, 28.5.0.6+, or 29.0.6+. For inets, use 9.3.2.7+, 9.6.2.3+, or 9.7.2+. If upgrading isn't immediate, disable chunked transfer encoding in your HTTP server configuration or set strict max_body_size limits to prevent oversized payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74835. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart