PT-2025-37165 · Unknown+5 · Erlang/Otp+5

Ingela Andin + 1 · Published 2025-09-11 · Updated 2026-01-09 · CVE-2025-48041

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 17.0 through 28.0.3 Erlang OTP versions 26.2.5.15 Erlang OTP versions 27.3.4.3

Description An Allocation of Resources Without Limits or Throttling issue exists in the Erlang OTP ssh (ssh sftp modules), potentially leading to Excessive Allocation and Flooding. The vulnerability is associated with the ssh sftpd.erl file.

Recommendations Update Erlang OTP to a version later than 28.0.3. Update Erlang OTP to a version later than 26.2.5.15. Update Erlang OTP to a version later than 27.3.4.3.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

AZL-67121

AZL-67124

BDU:2025-13918

CVE-2025-48041

DLA-4376-1

GHSA-79C4-CVV7-4QM3

OESA-2026-1030

OESA-2026-1031

OPENSUSE-SU-2025:15740-1

SUSE-SU-2025:3807-1

SUSE-SU-2025:4035-1

SUSE-SU-2025_3807-1

SUSE-SU-2025_4035-1

USN-7831-1

Affected Products

Debian

Erlang/Otp

Linuxmint

Red Os

Suse

Ubuntu

References · 42

• https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3 · Vendor Advisory
• https://github.com/erlang/otp/pull/10157 · Patch
• https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288 · Patch
• https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401 · Patch
• https://ubuntu.com/security/CVE-2025-48040 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48039 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2025-48041 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-48041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48039 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48041 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3807-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48038 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-48041 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1031 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-67121 · Vendor Advisory