---
id: CVE-2026-74835
title: "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP\_17.0 before OTP\_27.3.4.17, from OTP\_28.0 before OTP\_28.5.0.6, and from OTP\_29.0 before OTP\_29.0.6,…"
summary: "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP\_17.0 before OTP\_27.3.4.17, from OTP\_28.0 before OTP\_28.5.0.6, and from OTP\_29.0 before OTP\_29.0.6,…"
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-770
  - CWE-1284
vendor: Erlang
product: otp
affected:
  - otp >= 17.0 < 27.3.4.17
  - otp >= 28.0 < 28.5.0.6
  - otp >= 29.0 < 29.0.6
  - inets >= 5.10 < 9.3.2.7
  - inets >= 9.4 < 9.6.2.3
  - inets >= 9.7 < 9.7.2
  - erlang/otp >= 84adefa331c4159d432d22840663c38f155cd4c1 < *
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T01:17:54.277'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74835'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-74835.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-74835'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74835.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-74835'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2526842'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-74835'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74835'
  - url: 'https://access.redhat.com/errata/RHSA-2026:62531'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-01T15:57:17.154573Z'
cvssSource: cna
epss: 0.00577
epssPercentile: 0.45201
ingestedAt: '2026-09-08T15:33:26.957Z'
patched:
  - hardened_images
scores:
  cna: 8.7
  vendor: 7.5
---

## Overview

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:62531** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62531)
- **Red Hat VEX** · Important · affected: Red Hat OpenShift Dev Spaces · no fix planned: Red Hat OpenShift Dev Spaces · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74835.json)