CVE-2025-48039

EUVD-2025-27678
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 31.92%
Debian logo
Debian Releases
Debian Product
Codename
erlang
bookworm
1:25.2.3+dfsg-1+deb12u4
fixed
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
1:23.2.6+dfsg-1+deb11u4
fixed
forky
1:29.0.4+dfsg-1
fixed
sid
1:29.0.4+dfsg-1
fixed
trixie
1:27.3.4.1+dfsg-1+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
erlang
bionic
Fixed 1:20.2.2+dfsg-1ubuntu2+esm2
released
focal
Fixed 1:22.2.7+dfsg-1ubuntu0.5+esm1
released
jammy
Fixed 1:24.2.1+dfsg-1ubuntu0.6
released
noble
Fixed 1:25.3.2.8+dfsg-1ubuntu4.5
released
plucky
Fixed 1:27.3+dfsg-1ubuntu1.3
released
questing
Fixed 1:27.3.4.1+dfsg-1ubuntu0.1
released
trusty
Fixed 1:16.b.3-dfsg-1ubuntu2.2+esm1
released
xenial
Fixed 1:18.3-dfsg-1ubuntu3.1+esm2
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
erlang
suse enterprise sap 15 SP7
23.3.4.19-150300.3.29.1
fixed
suse enterprise server 15 SP4
23.3.4.19-150300.3.29.1
fixed
suse enterprise server 15 SP7
23.3.4.19-150300.3.29.1
fixed
erlang-epmd
suse enterprise sap 15 SP7
23.3.4.19-150300.3.29.1
fixed
suse enterprise server 15 SP4
23.3.4.19-150300.3.29.1
fixed
suse enterprise server 15 SP7
23.3.4.19-150300.3.29.1
fixed
erlang26
suse enterprise sap 15 SP7
26.2.1-150300.7.22.1
fixed
suse enterprise server 15 SP7
26.2.1-150300.7.22.1
fixed
erlang26-epmd
suse enterprise sap 15 SP7
26.2.1-150300.7.22.1
fixed
suse enterprise server 15 SP7
26.2.1-150300.7.22.1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
erlang
Azure Linux 3.0
0:26.2.5.15-1.azl3
fixed
CBL-Mariner 2.0
0:25.3.2.21-4.cm2
fixed
Common Weakness Enumeration
References
https://cna.erlef.org/cves/CVE-2025-48039.html
https://github.com/erlang/otp/commit/043ee3c943e2977c1acdd740ad13992fd60b6bf0
https://github.com/erlang/otp/commit/c242e6458967e9514bea351814151695807a54ac
https://github.com/erlang/otp/pull/10155
https://github.com/erlang/otp/security/advisories/GHSA-rr5p-6856-j7h8
https://osv.dev/vulnerability/EEF-CVE-2025-48039
https://www.erlang.org/doc/system/versions.html#order-of-versions