Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-74835— inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

Quick assessment

Affected

Erlang OTP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang OTP是Erlang组织的一个构建电信级应用的高并发开发框架。 Erlang OTP 17.0版本至27.3.4.17之前版本、28.0版本至28.5.0.6之前版本和29.0版本至29.0.6之前版本存在资源管理错误漏洞，该漏洞源于HTTP服务器httpd未能对分块请求强制执行配置的正文大小限制，可能导致拒绝服务攻击。

CVSS 8.7 · High EPSS 0.58% · P47 Updated Sep 08, 2026

Possible ATT&CK Techniques 2 AI

T1071 · Application Layer Protocol T1025 · Data from Removable Media

Affected Version Matrix 9

Vendor	Product	Version Range	Status
Erlang	OTP	`< 17.0`	unknown
		`17.0< 27.3.4.17`	affected
		`28.0< 28.5.0.6`	affected
		`29.0< 29.0.6`	affected
		`< 5.10`	unknown
		`5.10< 9.3.2.7`	affected
		`9.4< 9.6.2.3`	affected
		`9.7< 9.7.2`	affected
… +1 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74835

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

Source: CVE Program / CVE List V5

Vulnerability Description

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Vulnerability Title

Erlang OTP 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Erlang	OTP	17.0 ~ 27.3.4.17	`cpe:2.3:a:erlang:erlang\/otp::::::::`
Erlang	OTP	5.10 ~ 9.3.2.7	`cpe:2.3:a:erlang:erlang\/otp::::::::`
Erlang	OTP	84adefa331c4159d432d22840663c38f155cd4c1 ~ *	`cpe:2.3:a:erlang:erlang\/otp::::::::`

II. Public POCs for CVE-2026-74835

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-74835

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74835 (3)

Vendor Advisories for CVE-2026-74835 (3)

🔗 EEF-CVE-2026-74835 - OSV related
🔗 CVE-2026-74835 Read full article related
🔗 Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception in httpd · Advisory · erlang/otp · GitHub Read full article vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-74835

Same Patch Batch · Erlang · 2026-09-01 · 16 CVEs total

CVE-2026-71380	8.7 HIGH	httpd applies no timeout while receiving a request body, parking a worker on a stalled cli
CVE-2026-70399	8.7 HIGH	httpd does not enforce the documented default max_clients connection limit
CVE-2026-69664	8.7 HIGH	httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
CVE-2026-66357	8.3 HIGH	inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
CVE-2026-73812	8.3 HIGH	inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
CVE-2026-73276	8.3 HIGH	inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
CVE-2026-55951	8.2 HIGH	httpc memory exhaustion via unbounded response header accumulation
CVE-2026-75538	8.2 HIGH	A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into
CVE-2026-66835	8.2 HIGH	httpd mod_auth directory protection bypassed by a doubled slash in the request path
CVE-2026-73270	8.2 HIGH	httpd mod_auth directory protection bypassed by request path casing on case-insensitive fi
CVE-2026-59696	6.9 MEDIUM	uri_string does not bound the port component of a URI before integer conversion
CVE-2026-71562	6.3 MEDIUM	httpc does not bound server-supplied numeric header values before integer conversion
CVE-2026-70405	6.3 MEDIUM	snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
CVE-2026-70409	6.3 MEDIUM	eldap does not bound the port component of a referral URL before integer conversion
CVE-2026-74994	6.0 MEDIUM	inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

IV. Related Vulnerabilities

Same product: OTP

Same vendor: Erlang

Same weakness: CWE-770