CVE-2025-48040

Description

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

CVSS breakdown

CVSS 4.0

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Confidentiality (Vulnerable System)

None

Integrity (Vulnerable System)

None

Availability (Vulnerable System)

Low

Confidentiality (Subsequent System)

None

Integrity (Subsequent System)

None

Availability (Subsequent System)

None

Affected products

erlang / erlang/otp

References

VENDOR_ADVISORYhttps://github.com/erlang/otp/security/advisories/GHSA-h7rg-6rjg-4cph
MISChttps://cna.erlef.org/cves/CVE-2025-48040.html
MISChttps://osv.dev/vulnerability/EEF-CVE-2025-48040
MISChttps://www.erlang.org/doc/system/versions.html#order-of-versions
PATCHhttps://github.com/erlang/otp/pull/10162
PATCHhttps://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a
PATCHhttps://github.com/erlang/otp/commit/548f1295d86d0803da884db8685cc16d461d0d5a