CVE-2026-74835: 
Erlang OTP vulnerability analysis and mitigation

CVE-2026-74835 is a Denial of Service vulnerability in the Erlang/OTP inets application's HTTP server (httpd) caused by failure to enforce a configured max_body_size limit on chunked HTTP requests. The vulnerability was published on September 1, 2026, and affects Erlang/OTP from version 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6 (corresponding to inets versions 5.10–9.3.2.7, 9.4–9.6.2.3, and 9.7–9.7.2). Versions prior to OTP 17.0 have unknown status. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1284 (Improper Validation of Specified Quantity in Input). In the vulnerable code path within lib/inets/src/http_lib/http_chunk.erl, the max_body_size limit was only evaluated upon receipt of a complete chunk — meaning an attacker could declare an arbitrarily large chunk size and stream data indefinitely without ever completing the chunk, bypassing the limit entirely. Because the server accumulates all received bytes in memory for the duration of the request, a single connection is sufficient to drive the Erlang node to memory exhaustion. The fix, applied in commits 0bceff0, 8e1ca42, and 7f9c460, changes the logic to check the declared chunk size against the accumulated body length at parse time and to measure incoming data against the limit as it arrives, responding with HTTP 413 when the limit is exceeded (GitHub Advisory, OTP Commit).

Successful exploitation allows an unauthenticated remote attacker to cause memory exhaustion on the affected Erlang node, leading to server crash or complete unresponsiveness. Only servers that explicitly configure max_body_size to a finite value are affected — the default configuration of nolimit is not considered vulnerable because no limit is expected to be enforced. There is no confidentiality or integrity impact; the sole consequence is loss of availability of the HTTP service and potentially the entire Erlang node (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of publication (Red Hat CVE). The vulnerability is network-exploitable with no authentication, no user interaction, and low attack complexity, making it automatable. The EPSS score is approximately 0.33%, indicating a low but non-negligible probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was responsibly disclosed by Lukas Backström at Erlang Solutions (GitHub Advisory).

1. Reconnaissance: Identify internet-facing services running Erlang/OTP's inets httpd with a finite max_body_size configured, using network scanning tools (e.g., Shodan, Censys) or by probing HTTP responses for Erlang-specific server headers.
2. Craft chunked request: Construct an HTTP/1.1 POST request with the Transfer-Encoding: chunked header targeting any endpoint served by the vulnerable httpd.
3. Declare oversized chunk: In the request body, send a chunk size line with a very large hexadecimal value (e.g., FFFFFFFF\r\n) to declare a chunk far exceeding the configured max_body_size.
4. Stream data without completing the chunk: Begin streaming arbitrary body data (e.g., repeated A bytes) at any rate without ever sending the chunk terminator (\r\n). Because the limit was only checked on chunk completion, the server buffers all received bytes in memory.
5. Exhaust server memory: Continue streaming data until the Erlang node's available memory is exhausted, causing the HTTP server process — and potentially the entire node — to crash or become unresponsive (GitHub Advisory, OTP Commit).

• Network: Persistent long-lived HTTP connections sending Transfer-Encoding: chunked POST requests that never complete; unusually high inbound data volume on the HTTP port from a single source IP without corresponding server responses.
• Logs: inets httpd access logs showing chunked POST requests that remain open for extended periods without a response code being logged; absence of HTTP 413 responses in logs despite large request bodies (pre-patch behavior).
• Process/System: Rapid and sustained growth in Erlang VM memory consumption (beam.smp process RSS); Erlang crash dumps (erl_crash.dump) generated due to out-of-memory conditions; system-level OOM killer events targeting the Erlang beam process.
• Application: Erlang node becoming unresponsive to health checks or other HTTP requests while a chunked connection remains open (GitHub Advisory).

Upgrade Erlang/OTP to one of the patched versions: OTP 27.3.4.17 (inets 9.3.2.7), OTP 28.5.0.6 (inets 9.6.2.3), or OTP 29.0.6 (inets 9.7.2). There is no httpd configuration option that mitigates this issue in unpatched versions. As an external workaround, place a reverse proxy (e.g., nginx with client_max_body_size) in front of httpd to reject oversized chunked bodies before they reach the Erlang server, or restrict access to the HTTP server to trusted clients only. Microsoft has also issued updates for affected Azure Linux packages (GitHub Advisory, Microsoft MSRC, Red Hat CVE).

The vulnerability was responsibly disclosed by Lukas Backström of Erlang Solutions and credited in the official GitHub Security Advisory. Red Hat issued a CVE advisory tracking the issue, and Microsoft included it in the September 2026 Patch Tuesday update cycle, which was covered by BleepingComputer (BleepingComputer). No significant independent researcher commentary or broad social media discussion has been identified beyond standard vulnerability aggregator coverage.