# CVE-2026-74835: Erlang OTP inets HTTP server body-size limit bypass in chunked requests

Source: https://junglewise.ai/threats/cve-2026-74835-erlang-otp-inets-http-server-body-size-limit-bypass-in-chunked  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74835 · Severity: info · CVSS 8.7 · Published 2026-09-01

The Erlang OTP inets application provides an HTTP server component used in production systems to handle web traffic. The httpd server fails to enforce configured limits on request body size when processing HTTP chunked transfer encoding, allowing attackers to send arbitrarily large payloads and exhaust server memory, resulting in denial of service.

Technologies: [Erlang Inets](https://junglewise.ai/threats/technologies/inets), [Erlang OTP](https://junglewise.ai/threats/technologies/otp). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-74835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74835 being exploited in the wild.

**How severe is CVE-2026-74835?** Informational severity, with a CVSS score of 8.7, published 1 September 2026.

**Which products and versions are affected?** Erlang Inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2; Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.

**Is there a fix for CVE-2026-74835?** A patch was published on 2026-09-01: OTP 27.3.4.17, 28.5.0.6, 29.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74835 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-74835?** Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource exhaustion issue (CWE-770) in the inets httpd HTTP server where the max_body_size configuration limit is not applied to chunked HTTP requests. An unauthenticated network attacker can send a series of chunked HTTP POST/PUT requests with individually small chunks that collectively exceed the configured body-size limit, causing unbounded memory allocation and eventual denial of service. The vulnerability affects OTP versions 17.0–27.3.4.16, 28.0–28.5.0.5, and 29.0–29.0.5. Patches are available in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 respectively.

## Affected products

- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2

## Timeline

- 2026-09-01: disclosed
- 2026-09-01: patched: OTP 27.3.4.17, 28.5.0.6, 29.0.6 released

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-74835.html](https://cna.erlef.org/cves/CVE-2026-74835.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)