CVE-2026-74835 Erlang CVE debrief

Who should care

Defenders responsible for OTP and inets deployments, especially those using versions before OTP 17.0, should assess exposure and prioritize verification and potential remediation. They should verify exposure, assess the need for compensating controls, and prioritize patching or updating affected versions. This includes reviewing and applying patches or updates from the vendor once available and considering inventory checks for systems using affected OTP

Why it matters

CVE-2026-74835 is a HIGH-severity vulnerability in the inets application HTTP server httpd, affecting OTP and inets deployments. Defenders should verify exposure, assess the need for compensating controls, and prioritize patching or updating affected versions.

• Verify exposure in OTP and inets deployments, especially for versions before OTP 17.0.
• Assess the need for compensating controls, such as limiting request sizes or monitoring for suspicious activity.
• Prioritize patching or updating affected OTP and inets versions.

Technical summary

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked requests. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity. Defenders should prioritize verifying exposure in their OTP and inets deployments, especially for versions before OTP 17.0, and assess the need for compensating controls.

Defensive priority

Defenders should prioritize verifying exposure in their OTP and inets deployments, especially for versions before OTP 17.0, and assess the need for compensating controls.

Recommended defensive actions

• Verify OTP and inets versions in your environment against the affected versions.
• Assess the need for compensating controls, such as limiting request sizes or monitoring for suspicious activity.
• Review and apply patches or updates from the vendor once available.
• Consider inventory checks for systems using affected OTP and inets versions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the affected scope for OTP versions before 17.0 is unknown and requires further verification. The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked requests. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.