PT-2026-25165 · Erlang Solutions+1 · Erlang/Otp+1
Jakub Witczak
+1
·
Publicado
2026-03-13
·
Atualizado
2026-06-03
·
CVE-2026-23943
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Erlang OTP versions 17.0 through 28.4.1
Erlang OTP versions 26.2.5.18 through 27.3.4.9
Description
An issue exists in Erlang OTP ssh (ssh transport modules) that allows for Denial of Service via Resource Depletion. The SSH transport layer, by default, advertises legacy zlib compression and inflates attacker-controlled payloads without a size limit before authentication. This enables a reliable memory exhaustion attack. Two compression algorithms are affected: zlib, which activates immediately after key exchange, and zlib@openssh.com, which activates post-authentication. Each SSH packet can decompress approximately 255 MB from 256 KB of data, resulting in a 1029:1 amplification ratio. Multiple packets can quickly exhaust available memory, potentially causing Out-Of-Memory (OOM) kills in environments with limited memory. The issue is associated with the
ssh transport.erl file and the ssh transport:decompress/2 and ssh transport:handle packet part/4 routines.Recommendations
Update Erlang OTP to a version later than 28.4.1.
Update Erlang OTP to a version later than 27.3.4.9.
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Erlang/Otp
Red Os