Weakness Type (CWE)

CWE-770 — CWE-770 Allocation of Resources Without Limits or Throttling

CAPEC

CVSS 4.0 Score

5.3

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

Affected

pkg:otp/ssh

Module Source File
ssh_sftp lib/ssh/src/ssh_sftpd.erl
Status Type Version Changes / Fixed in
affected otp ⓘ 3.0.1
  • unaffected at 5.3.3
  • unaffected at 5.2.11.3
  • unaffected at 5.1.4.12

pkg:github/erlang/otp

Module Source File
ssh_sftp lib/ssh/src/ssh_sftpd.erl
Status Type Version Changes / Fixed in
affected otp ⓘ 17.0
affected git ⓘ 07b8f441ca71

Configurations

The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting {subsystems, []} in the SSH daemon configuration.

Workarounds

  • Disable sftp
  • limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated

References

Credits

  • Remediation developer: Jakub Witczak
  • Remediation reviewer: Ingela Andin

CVE record as JSON:  GET /cves/CVE-2025-48038.json
OSV record as JSON:  GET /osv/EEF-CVE-2025-48038.json