CVE-2025-48041 · published 2025-09-11 · updated 2026-07-24

SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

HIGH 7.1 CWE-770 · Allocation of Resources Without Limits or Throttling CWE-400 · Uncontrolled Resource Consumption
OSV.dev JSON

Am I affected?

This record states its affected versions in a form that can't be compared automatically.

≥ 3.0.1 and up affected
→ 5.3.3 not affected
→ 5.2.11.3 not affected
→ 5.1.4.12 not affected
every other version: unknown

Description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Weaknesses & attack patterns

Weakness

CWE-770 · Allocation of Resources Without Limits or Throttling in catalog → MITRE ↗
CWE-400 · Uncontrolled Resource Consumption in catalog → MITRE ↗

Attack patterns

CAPEC-130 · Excessive Allocation MITRE ↗
CAPEC-125 · Flooding MITRE ↗

Affected — Erlang / ssh Repository ↗

≥ 3.0.1 and up affected
→ 5.3.3 not affected
→ 5.2.11.3 not affected
→ 5.1.4.12 not affected
every other version: unknown
default status unknown
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
modules · source files
modules ssh_sftp
source files lib/ssh/src/ssh_sftpd.erl

Affected — GitHub / erlang/otp Repository ↗

≥ 17.0 and up affected
→ 28.0.3 not affected
→ 27.3.4.3 not affected
→ 26.2.5.15 not affected
≥ 07b8f44 and up affected
→ 5f9af63 not affected
→ d49efa2 not affected
every other version: unknown
default status unknown
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
modules · source files
modules ssh_sftp
source files lib/ssh/src/ssh_sftpd.erl

Workarounds

  • disabling SFTP
  • limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated

Configurations

The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting {subsystems, []} in the SSH daemon configuration.

References

github.com/erlang/otp · GHSA-79c4-cvv7-4qm3 ↗ vendor-advisory
https://github.com/erlang/otp/pull/10157 patch
github.com/erlang/otp · 5f9af63 ↗ patch
github.com/erlang/otp · d49efa2 ↗ patch
osv.dev · EEF-CVE-2025-48041 ↗ related

Credits

Jakub Witczak Remediation developer
Ingela Anderton Andin Remediation reviewer

CVSS breakdown

HIGH 7.1 open in calculator →
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
« All CVEs