The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Metrics
Affected Vendors & Products
References
History
Tue, 01 Sep 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Erlang erlang/otp
Erlang otp |
|
| Vendors & Products |
Erlang erlang/otp
Erlang otp |
|
| Metrics |
ssvc
|
Tue, 01 Sep 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown. | |
| Title | inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception | |
| First Time appeared |
Erlang
Erlang erlang\/otp |
|
| Weaknesses | CWE-770 | |
| CPEs | cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Erlang
Erlang erlang\/otp |
|
| References |
|
|
| Metrics |
cvssV4_0
|
Status: PUBLISHED
Assigner: EEF
Published: 2026-09-01T14:45:16.377Z
Updated: 2026-09-01T15:57:22.906Z
Reserved: 2026-08-17T12:30:01.524Z
Link: CVE-2026-74835
Updated: 2026-09-01T15:57:19.974Z
Status : Deferred
Published: 2026-09-01T15:17:25.730
Modified: 2026-09-01T21:15:00.147
Link: CVE-2026-74835
No data.