medium5.3
CVE-2025-48038
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.
Impact
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://cna.erlef.org/cves/CVE-2025-48038.html
- https://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a
- https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f
- https://github.com/erlang/otp/pull/10156
- https://github.com/erlang/otp/security/advisories/GHSA-pvj7-9652-7h9r
- https://osv.dev/vulnerability/EEF-CVE-2025-48038
- https://www.erlang.org/doc/system/versions.html#order-of-versions