PT-2025-13543 · Ericsson+6 · Erlang/Otp+6
Published
2025-03-28
·
Updated
2025-05-09
·
CVE-2025-30211
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Erlang/OTP versions prior to 27.3.1
Erlang/OTP versions prior to 26.2.5.10
Erlang/OTP versions prior to 25.3.2.19
Description
A maliciously formed KEX init message can result in high memory usage due to the implementation not verifying RFC specified limits on algorithm names provided in the KEX init message. This can lead to inefficient processing of error data and a large amount of memory being allocated for processing malicious data.
Recommendations
For versions prior to 27.3.1, update to version 27.3.1 or later.
For versions prior to 26.2.5.10, update to version 26.2.5.10 or later.
For versions prior to 25.3.2.19, update to version 25.3.2.19 or later.
As a temporary workaround, consider setting the option
parallel login to false and/or reducing the max sessions option to minimize the risk of exploitation.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Erlang/Otp
Linuxmint
Red Os
Suse
Ubuntu