CVE-2026-74835

CVE-2026-74835 is a resource-limit flaw (CWE-770) in the httpd HTTP server of the inets application shipped with Erlang/OTP: when a client sends a request with a chunked transfer-encoded body, httpd fails to enforce the configured maximum body size. An unauthenticated remote attacker can therefore send an arbitrarily large chunked request body to an httpd instance, causing resource exhaustion and denial of service; the CVSS 4.0 score of 8.7 reflects network exploitation with high availability impact only (VA:H). The affected ranges are OTP 17.0 to before 27.3.4.17, OTP 28.0 to before 28.5.0.6, and OTP 29.0 to before 29.0.6, corresponding to inets 5.10 to before 9.3.2.7, 9.4 to before 9.6.2.3, and 9.7 to before 9.7.2; whether OTP releases older than 17.0 (inets before 5.10) are affected is unknown. Only deployments that actually start the inets httpd server are exposed; the much larger population of OTP runtimes (RabbitMQ, CouchDB, Elixir and telecom software) is not exploitable through this flaw unless httpd is running. There is no known public exploit or PoC, the flaw is not in CISA KEV, and EPSS puts the 30-day exploitation probability at about 0.3%.

What to do: Upgrade to OTP 27.3.4.17 (inets 9.3.2.7), OTP 28.5.0.6 (inets 9.6.2.3), or OTP 29.0.6 (inets 9.7.2), or later. Determine whether you actually run the inets httpd server (it must be explicitly configured and started) and whether it is network-reachable; if it is, restrict access to it or place a reverse proxy that limits request body size in front of it until patched.