CVE-2026-74835: inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

CSIRTS triage

What

Memory exhaustion in httpd via unenforced max_body_size limit during chunked request body reception.

Who is affected

Erlang/OTP httpd and inets deployments receiving HTTP requests with chunked transfer encoding.

Urgency

Severity unknown; memory exhaustion DoS affects service availability and requires prompt patching.

Action

Upgrade Erlang/OTP to patched version and verify max_body_size configuration is correctly enforced.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

Microsoft Security Response Center (INTL · vendor-psirt · site)

Severity

unknown

Published

2026-09-02

Exploitation

Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-74835

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-748350.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• medium[NEW] [medium] Erlang/OTP: Multiple vulnerabilitiescert-bund
• unknownCVE-2026-74835: The inets application HTTP server httpd fails to enforce a configured body-size limit on chunk…nvd

Recent advisories for inets,httpd

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownCVE-2026-73276: inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping imsrc · 2026-09-02
• unknownCVE-2026-73812: inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Lengthmsrc · 2026-09-02
• unknownCVE-2026-74994: inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_authmsrc · 2026-09-02
• unknownCVE-2026-66357: inets,httpd:HTTP Request Smuggling via obs-fold Header Continuationmsrc · 2026-09-02
• unknownCVE-2026-74994: The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentic…nvd · 2026-09-01
• unknownCVE-2026-73270: Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote …nvd · 2026-09-01

More from Microsoft Security Response Center

• unknownCVE-2026-55951: httpc memory exhaustion via unbounded response header accumulation2026-09-02
• mediumCVE-2026-56143: Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Ser…2026-09-02
• highCVE-2026-14957: FIPS mode assertion failure via malicious CERT payload2026-09-02
• lowCVE-2026-18743: Popt-devel: popt-static: short realloc in poptconfigfiletostring2026-09-02
• unknownCVE-2026-59696: uri_string does not bound the port component of a URI before integer conversion2026-09-02