CVE-2026-74835

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74835", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-08-17T12:30:01.524Z", "datePublished": "2026-09-01T14:45:16.377Z", "dateUpdated": "2026-11-11T13:45:05.856Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.17", "status": "unaffected"}, {"at": "28.5.0.6", "status": "unaffected"}, {"at": "29.0.6", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "inets", "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "9.3.2.7", "status": "unaffected"}, {"at": "9.6.2.3", "status": "unaffected"}, {"at": "9.7.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86", "status": "unaffected"}, {"at": "8e1ca42b64df6c41306affbe8dc129bdbd4042c7", "status": "unaffected"}, {"at": "7f9c460d1818c2afb78fbd01f8d8b81343bbb011", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "8e1ca42b64df6c41306affbe8dc129bdbd4042c7", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "7f9c460d1818c2afb78fbd01f8d8b81343bbb011", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.5.0.6", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "29.0.6", "versionStartIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Lukas Backstr\u00f6m / Erlang Solutions"}, {"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak / Ericsson"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;27.3.4.17, OTP&nbsp;28.5.0.6, and OTP&nbsp;29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP&nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.</p>"}, {"base64": false, "type": "text/markdown", "value": "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, OTP\u00a028.5.0.6, and OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "value": "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, OTP\u00a028.5.0.6, and OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}, {"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T13:45:05.856Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5"}, {"name": "EEF CNA record for CVE-2026-74835", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-74835.html"}, {"name": "OSV record EEF-CVE-2026-74835", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-74835"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Fix commit 0bceff0 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86"}, {"name": "Fix commit 8e1ca42 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7"}, {"name": "Fix commit 7f9c460 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011"}], "source": {"discovery": "UNKNOWN"}, "title": "inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-01T15:57:17.154573Z", "id": "CVE-2026-74835", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T15:57:22.906Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74835", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T15:57:17.154573Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T15:57:19.974Z"}}], "cna": {"title": "inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lukas Backstr\u00f6m / Erlang Solutions"}, {"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak / Ericsson"}], "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}, {"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "27.3.4.17", "status": "unaffected"}, {"at": "28.5.0.6", "status": "unaffected"}, {"at": "29.0.6", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "9.3.2.7", "status": "unaffected"}, {"at": "9.6.2.3", "status": "unaffected"}, {"at": "9.7.2", "status": "unaffected"}], "version": "5.10", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "inets", "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86", "status": "unaffected"}, {"at": "8e1ca42b64df6c41306affbe8dc129bdbd4042c7", "status": "unaffected"}, {"at": "7f9c460d1818c2afb78fbd01f8d8b81343bbb011", "status": "unaffected"}], "version": "84adefa331c4159d432d22840663c38f155cd4c1", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "8e1ca42b64df6c41306affbe8dc129bdbd4042c7", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "7f9c460d1818c2afb78fbd01f8d8b81343bbb011", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "collectionURL": "https://github.com", "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5", "tags": ["vendor-advisory"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-74835.html", "name": "EEF CNA record for CVE-2026-74835", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-74835", "name": "OSV record EEF-CVE-2026-74835", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86", "name": "Fix commit 0bceff0 in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7", "name": "Fix commit 8e1ca42 in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011", "name": "Fix commit 7f9c460 in erlang/otp", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, OTP\u00a028.5.0.6, and OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "supportingMedia": [{"type": "text/html", "value": "<p>The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;27.3.4.17, OTP&nbsp;28.5.0.6, and OTP&nbsp;29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP&nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.</p>", "base64": false}, {"type": "text/markdown", "value": "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, OTP\u00a028.5.0.6, and OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.17"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.5.0.6", "versionStartIncluding": "28.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "29.0.6", "versionStartIncluding": "29.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T13:37:32.801Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74835", "state": "PUBLISHED", "dateUpdated": "2026-11-11T13:37:32.801Z", "dateReserved": "2026-08-17T12:30:01.524Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-09-01T14:45:16.377Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.17", "status": "unaffected"}, {"at": "28.5.0.6", "status": "unaffected"}, {"at": "29.0.6", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "inets", "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "9.3.2.7", "status": "unaffected"}, {"at": "9.6.2.3", "status": "unaffected"}, {"at": "9.7.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86", "status": "unaffected"}, {"at": "8e1ca42b64df6c41306affbe8dc129bdbd4042c7", "status": "unaffected"}, {"at": "7f9c460d1818c2afb78fbd01f8d8b81343bbb011", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "8e1ca42b64df6c41306affbe8dc129bdbd4042c7", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "7f9c460d1818c2afb78fbd01f8d8b81343bbb011", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, OTP\u00a028.5.0.6, and OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "id": "CVE-2026-74835", "lastModified": "2026-11-11T14:17:46.257", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74835", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-01T15:57:17.154573Z", "version": "2.0.3"}}]}, "published": "2026-09-01T15:17:25.730", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-74835.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-74835"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "inets: httpd: otp: inets httpd: Denial of Service due to memory exhaustion via unenforced body-size limit", "id": "2526842", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526842"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1284", "details": ["The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "A flaw was found in the inets application HTTP server httpd. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted chunked request that fails to enforce a configured body-size limit. This can lead to memory exhaustion, causing a Denial of Service (DoS) on the affected system."], "name": "CVE-2026-74835", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-09-01T14:45:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74835\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74835\nhttps://cna.erlef.org/cves/CVE-2026-74835.html\nhttps://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86\nhttps://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011\nhttps://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7\nhttps://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5\nhttps://osv.dev/vulnerability/EEF-CVE-2026-74835"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,27.3.4.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[28.0,28.5.0.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[29.0,29.0.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10,9.3.2.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.4,9.6.2.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.7,9.7.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84adefa331c4159d432d22840663c38f155cd4c1,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,27.3.4.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[28.0,28.5.0.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[29.0,29.0.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10,9.3.2.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.4,9.6.2.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.7,9.7.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84adefa331c4159d432d22840663c38f155cd4c1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "created": "2026-09-01T17:15:04.933796+00:00", "updated": "2026-09-03T14:30:05.608465+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp", "erlang$PRODUCT$otp"]}