PT-2025-37165 · Unknown+5 · Erlang/Otp+5

Ingela Andin + 1 · CVE-2025-48041 · Published 2025-09-11 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 17.0 through 28.0.3 Erlang OTP versions 26.2.5.15 Erlang OTP versions 27.3.4.3

Description An Allocation of Resources Without Limits or Throttling issue exists in the Erlang OTP ssh (ssh sftp modules), potentially leading to Excessive Allocation and Flooding. The vulnerability is associated with the ssh sftpd.erl file.

Recommendations Update Erlang OTP to a version later than 28.0.3. Update Erlang OTP to a version later than 26.2.5.15. Update Erlang OTP to a version later than 27.3.4.3.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

AZL-67121

AZL-67124

BDU:2025-13918

CVE-2025-48041

DLA-4376-1

GHSA-79C4-CVV7-4QM3

OESA-2026-1030

OESA-2026-1031

OPENSUSE-SU-2025:15740-1

SUSE-SU-2025:3807-1

SUSE-SU-2025:4035-1

SUSE-SU-2025_3807-1

SUSE-SU-2025_4035-1

USN-7831-1

Affected Products

Debian

Erlang/Otp

Linuxmint

Red Os

Suse

Ubuntu

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48041.json · Exploit
• https://github.com/erlang/otp/pull/10157 · Patch
• https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288 · Patch
• https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401 · Patch
• https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1031 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-48041 · Security Note
• https://osv.dev/vulnerability/USN-7831-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-67124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48039 · Security Note
• https://ubuntu.com/security/CVE-2025-48038 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2025-48041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48041 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3807-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48040 · Vendor Advisory