# CVE-2026-74835: inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

Status: published. Published: 2026-09-01. Updated: 2026-11-11.

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011

## Affected products and versions

- Erlang / OTP (otp): ≥ 17.0; < * (affected, otp); unaffected at 27.3.4.17; unaffected at 28.5.0.6; unaffected at 29.0.6. Source: CNA: EEF
- Erlang / OTP (inets): ≥ 5.10; < * (affected, otp); unaffected at 9.3.2.7; unaffected at 9.6.2.3; unaffected at 9.7.2. Source: CNA: EEF
- Erlang / OTP (erlang/otp): ≥ 84adefa331c4159d432d22840663c38f155cd4c1; < * (affected, git); unaffected at 0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86; unaffected at 8e1ca42b64df6c41306affbe8dc129bdbd4042c7; unaffected at 7f9c460d1818c2afb78fbd01f8d8b81343bbb011; ≥ 0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86; < * (unaffected, git); ≥ 8e1ca42b64df6c41306affbe8dc129bdbd4042c7; < * (unaffected, git); ≥ 7f9c460d1818c2afb78fbd01f8d8b81343bbb011; < * (unaffected, git). Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 8.7 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N; source: CNA: EEF

- CISA KEV: No listing in collected sources

- EPSS: 0.58% as of 2026-11-10; percentile 47.87%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-770

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5 (CNA: EEF; vendor-advisory)

- https://cna.erlef.org/cves/CVE-2026-74835.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-74835 (CNA: EEF; related)

- https://www.erlang.org/doc/system/versions.html#order-of-versions (CNA: EEF; x_version-scheme)

- https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86 (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7 (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011 (CNA: EEF; patch)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-74835; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-74835; retrieved 2026-11-11; source updated Not reported

Revision: b6daad0f4f880001376e36e0db6edd07e9046f406772e1a2a19b63a45a8a18fd

Canonical: https://y2.dev/cve/CVE-2026-74835

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.