CVE-2026-74835

CVSS 8.7 (high) · published 2026-09-01

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Weakness: CWE-770

Source: NVD CVE-2026-74835

References

• https://cna.erlef.org/cves/CVE-2026-74835.html
• https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86
• https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011
• https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7
• https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5
• https://osv.dev/vulnerability/EEF-CVE-2026-74835
• https://www.erlang.org/doc/system/versions.html#order-of-versions

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.