CVE-2025-48040 · published 2025-09-11 · updated 2026-11-11

Malicious Key Exchange Messages may Lead to Excessive Resource Consumption

MEDIUM 6.9 CWE-400 · Uncontrolled Resource Consumption CWE-770 · Allocation of Resources Without Limits or Throttling
OSV.dev JSON

Am I affected?

type your erlang.org/otp version to check

Description

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3.

Weaknesses & attack patterns

Weakness

CWE-400 · Uncontrolled Resource Consumption in catalog → MITRE ↗
CWE-770 · Allocation of Resources Without Limits or Throttling in catalog → MITRE ↗

Attack patterns

CAPEC-130 · Excessive Allocation MITRE ↗
CAPEC-125 · Flooding MITRE ↗

Affected — Erlang

≥ 17.0 and up affected
→ 26.2.5.15 not affected
→ 27.3.4.3 not affected
→ 28.0.3 not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type otp
modules · source files
modules ssh_sftp
source files lib/ssh/src/ssh_sftpd.erl

Affected — Erlang / ssh Repository ↗

≥ 3.0.1 and up affected
→ 5.1.4.12 not affected
→ 5.2.11.3 not affected
→ 5.3.3 not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type otp
modules · source files
modules ssh_sftp
source files src/ssh_sftpd.erl

Affected — GitHub / erlang/otp Repository ↗

≥ 07b8f44 and up affected
→ 548f129 not affected
→ 7cd7abb not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type git
modules · source files
modules ssh_sftp
source files lib/ssh/src/ssh_sftpd.erl

Workarounds

  • set option parallel_login to false
  • reduce max_sessions option

References

SSH Malicious Key Exchange Messages may Lead to Excessive Resource Consumption (github.com) vendor-advisory
https://github.com/erlang/otp/pull/10162 patch
Fix commit 548f129 in erlang/otp (github.com) patch
Fix commit 7cd7abb in erlang/otp (github.com) patch
OSV record EEF-CVE-2025-48040 (osv.dev) related
Introducing commit 07b8f44 in erlang/otp (github.com) related

Credits

Jakub Witczak Remediation developer
Ingela Anderton Andin Remediation reviewer

CVSS breakdown

MEDIUM 6.9 open in calculator →
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
« All CVEs