Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Erlang SSH service can be overwhelmed causing disruption

published 2 months ago

Summary

Erlang versions from 17.0 up to 28.0.3 (including certain 27 and 26 releases) contain a flaw in the SSH file‑transfer component that lets a remote user consume unlimited resources. This can lead to slowdowns or crashes, affecting any system that relies on Erlang for communication services. Apply the latest Erlang/OTP security update to fix the issue and protect your applications.

What to do

Update openeuler erlang to version 25.3.2.6-19.oe2403sp3.

Affected software

Ecosystem	Vendor	Product	Affected versions
openEuler:24.03-LTS-SP3	openeuler	erlang	< 25.3.2.6-19.oe2403sp3 Fix: upgrade to 25.3.2.6-19.oe2403sp3

Original advisory text

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)

References

https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-48041 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.8 High

Timeline

Published5 Sep 2026

Updated5 Sep 2026

First seen5 Sep 2026

Sources

OESA-2026-3652 · OSV

Track software like this

Free during beta