CVE-2025-48038 · published 2025-09-11 · updated 2026-11-11

Unverified File Handles can Cause Excessive Use of System Resources

MEDIUM 5.3 CWE-770 · Allocation of Resources Without Limits or Throttling CWE-400 · Uncontrolled Resource Consumption
OSV.dev JSON

Am I affected?

type your erlang.org/otp version to check

Description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3.

Weaknesses & attack patterns

Weakness

CWE-770 · Allocation of Resources Without Limits or Throttling in catalog → MITRE ↗
CWE-400 · Uncontrolled Resource Consumption in catalog → MITRE ↗

Attack patterns

CAPEC-130 · Excessive Allocation MITRE ↗
CAPEC-131 · Resource Leak Exposure MITRE ↗

Affected — Erlang

≥ 17.0 and up affected
→ 26.2.5.15 not affected
→ 27.3.4.3 not affected
→ 28.0.3 not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type otp
modules · source files
modules ssh_sftpd
source files lib/ssh/src/ssh_sftpd.erl

Affected — Erlang / ssh Repository ↗

≥ 3.0.1 and up affected
→ 5.1.4.12 not affected
→ 5.2.11.3 not affected
→ 5.3.3 not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type otp
modules · source files
modules ssh_sftpd
source files src/ssh_sftpd.erl

Affected — GitHub / erlang/otp Repository ↗

≥ 07b8f44 and up affected
→ f09e020 not affected
→ 4e3bf86 not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type git
modules · source files
modules ssh_sftpd
source files lib/ssh/src/ssh_sftpd.erl

Workarounds

  • Disable sftp
  • limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated

Configurations

The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting {subsystems, []} in the SSH daemon configuration.

References

SSH Unverified File Handles can Cause Excessive Use of System Resources (github.com) vendor-advisory
https://github.com/erlang/otp/pull/10156 patch
Fix commit f09e020 in erlang/otp (github.com) patch
Fix commit 4e3bf86 in erlang/otp (github.com) patch
OSV record EEF-CVE-2025-48038 (osv.dev) related
Introducing commit 07b8f44 in erlang/otp (github.com) related

Credits

Jakub Witczak Remediation developer
Ingela Anderton Andin Remediation reviewer

CVSS breakdown

MEDIUM 5.3 open in calculator →
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
« All CVEs