OTP inets httpd CVE-2026-74835

The target must be running Erlang/OTP's inets httpd specifically (not Cowboy, Ranch, Phoenix, or any other HTTP server) on an affected OTP version. The inets httpd must be configured with a finite MaxBodySize limit; if MaxBodySize is set to the atom nolimit, no security boundary is configured and the bypass has no security impact. Chunked transfer encoding (Transfer-Encoding: chunked) is standard HTTP/1.1 behavior and does not require any special server-side configuration to trigger. No authentication is required (CVSS PR:N confirmed). Exploitation is limited to network paths where inets httpd is directly reachable from the attacker; applications fronted by a reverse proxy that enforces its own body size limits are protected.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scores 8.7, reflecting a remotely exploitable, unauthenticated, low-complexity attack with high availability impact and no confidentiality or integrity consequences. EPSS data is absent from the input and cannot be assessed. The CVE is not in the CISA KEV catalog and no public exploit code has been identified at time of analysis. Real-world risk is moderated by deployment footprint: most production Erlang/Elixir services use Cowboy, Ranch, or Phoenix/Plug rather than inets httpd, limiting the exposed population. For organizations that do expose inets httpd to untrusted networks, the attack is automatable and requires no exploit sophistication - standard HTTP chunked encoding suffices. SSVC signals: exploitation status = none confirmed; automatable = yes; technical impact = partial (availability only). The high CVSS score is appropriate for the class of vulnerability but should be weighed against actual inets httpd deployment prevalence in the affected environment.

An unauthenticated remote attacker sends an HTTP/1.1 POST request to an inets httpd endpoint using chunked transfer encoding, streaming many small chunks whose accumulated total far exceeds the server's configured MaxBodySize. Because the chunked decoder does not compare the running body total against MaxBodySize during accumulation, the OTP process buffers the entire oversized payload in memory, leading to memory exhaustion and denial of service for the targeted httpd node. No public exploit code is required - standard HTTP client tooling capable of sending chunked requests is sufficient.