CVE-2025-48038

Description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

CVSS breakdown

CVSS 4.0

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Confidentiality (Vulnerable System)

None

Integrity (Vulnerable System)

None

Availability (Vulnerable System)

Low

Confidentiality (Subsequent System)

None

Integrity (Subsequent System)

None

Availability (Subsequent System)

None

Affected products

erlang / erlang/otp

References

VENDOR_ADVISORYhttps://github.com/erlang/otp/security/advisories/GHSA-pvj7-9652-7h9r
MISChttps://cna.erlef.org/cves/CVE-2025-48038.html
MISChttps://osv.dev/vulnerability/EEF-CVE-2025-48038
MISChttps://www.erlang.org/doc/system/versions.html#order-of-versions
PATCHhttps://github.com/erlang/otp/pull/10156
PATCHhttps://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a
PATCHhttps://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f