CVE-2026-74835: OTP inets HTTP Server DoS Vulnerability

CVE-2026-74835 Overview

CVE-2026-74835 affects the inets application HTTP server (httpd) in Erlang/OTP. The server fails to enforce the configured max_body_size limit when clients send requests using HTTP chunked transfer encoding. An unauthenticated remote attacker can send arbitrarily large chunked request bodies that bypass the size limit, exhausting server memory and causing denial of service. The flaw is classified under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Remote unauthenticated attackers can bypass the max_body_size configuration to exhaust process memory on any Erlang/OTP httpd server, degrading or terminating availability of the hosting service.

Affected Products

Erlang/OTP 17.0 through versions before 27.3.4.17 (inets 5.10 through before 9.3.2.7)
Erlang/OTP 28.0 through versions before 28.5.0.6 (inets 9.4 through before 9.6.2.3)
Erlang/OTP 29.0 through versions before 29.0.6 (inets 9.7 through before 9.7.2)

Discovery Timeline

2026-09-01 - CVE-2026-74835 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-74835

Vulnerability Analysis

The inets HTTP server exposes a max_body_size configuration directive intended to cap the size of request bodies the server will accept. The server enforces this limit on requests using Content-Length, but the chunked transfer decoding path in httpd_request_handler.erl does not apply the check as each chunk arrives. An attacker can therefore stream request bodies of unbounded size while the server continues to buffer chunks in memory.

Because the request handler is spawned per-connection, a single attacker can open concurrent connections and stream data indefinitely, driving the Erlang VM toward memory exhaustion. The impact is limited to availability, which aligns with the vector components indicating no confidentiality or integrity impact.

Root Cause

The root cause is missing size accounting in the chunked decoding branch of the httpd_request_handler state machine. Only the terminal request-parsing path returned a {size_error, MaxSize, ErrCode, ErrStr} result to the handler. Intermediate chunk-processing callbacks accumulated data without comparing running totals against max_body_size, allowing the limit to be silently exceeded.

Attack Vector

Exploitation requires only network reachability to a vulnerable httpd listener. An attacker sends an HTTP request with Transfer-Encoding: chunked and streams chunks that collectively exceed the configured max_body_size. No authentication, user interaction, or knowledge of application logic is required. Repeated or parallel requests amplify memory pressure and can force process termination.

text

// Patch excerpt from lib/inets/src/http_server/httpd_request_handler.erl
		       end,
             handle_msg(Result, NewState);
 
+        %% error returns from httpd_request
 	{error, {size_error, MaxSize, ErrCode, ErrStr}, Version} ->
 	    NewModData =  ModData#mod{http_version = Version},
 	    httpd_response:send_status(NewModData, ErrCode, ErrStr, {max_size, MaxSize}),

Source: erlang/otp commit 0bceff0c. The patch wires the size_error result into the chunk-handling path so the configured max_body_size is enforced as chunks are received rather than only at request finalization.

Detection Methods for CVE-2026-74835

Indicators of Compromise

Sustained inbound HTTP requests to inets endpoints carrying Transfer-Encoding: chunked with unusually long-lived connections.
Erlang VM memory growth on hosts running httpd, particularly in request-handler processes, without a matching increase in completed requests.
Repeated beam.smp OOM events or erl_crash.dump files referencing httpd_request_handler on affected releases.

Detection Strategies

Inspect HTTP access and error logs for chunked requests whose cumulative byte counts exceed the configured max_body_size.
Correlate connection duration and bytes-received metrics from a reverse proxy or load balancer sitting in front of inets.
Alert on httpd_response:send_status calls with {max_size, _} after patching, as these indicate attempted exploitation being blocked.

Monitoring Recommendations

Track per-process memory in the Erlang VM using observer or telemetry exporters and alert on outliers among httpd_request_handler processes.
Monitor host-level memory pressure and OOM-killer activity on servers hosting inetshttpd.
Baseline typical request body sizes and flag statistical deviations in chunked traffic.

How to Mitigate CVE-2026-74835

Immediate Actions Required

Upgrade Erlang/OTP to 27.3.4.17, 28.5.0.6, or 29.0.6 (or later) depending on your release branch, which include inets9.3.2.7, 9.6.2.3, or 9.7.2 respectively.
Where immediate upgrade is not possible, place a reverse proxy in front of inets that terminates chunked encoding and enforces a maximum request body size.
Audit application configurations to confirm max_body_size is set to a value appropriate for the workload rather than left at defaults.

Patch Information

The fix is delivered in the Erlang/OTP repository across three commits: 0bceff0c, 7f9c460d, and 8e1ca42b. Full details are available in GitHub Security Advisory GHSA-8qrh-x566-5xv5 and the CNA advisory.

Workarounds

Front inets with a hardened reverse proxy (for example, nginx or HAProxy) that enforces client_max_body_size before requests reach Erlang.
Restrict network exposure of the httpd listener so only trusted clients can reach it while patches are staged.
Apply per-source rate limits and connection caps to reduce the blast radius of memory-exhaustion attempts.

bash

# nginx reverse-proxy example limiting chunked request bodies upstream of inets httpd
server {
    listen 443 ssl;
    server_name app.example.com;

    client_max_body_size 1m;
    client_body_timeout 10s;
    limit_conn perip 10;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_request_buffering on;
    }
}