PT-2026-48466 · Ssh+1 · Ssh+1

Jakub Witczak + 2 · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-48859

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 29.0 through 29.0.1 ssh versions 6.0 through 6.0.0

Description A timing side-channel in password authentication allows unauthenticated remote attackers to enumerate usernames. When the SSH daemon is configured with the user passwords or password option, the check password/3() function in the ssh auth module performs a PBKDF2-SHA256 computation for valid usernames, taking approximately 300ms. Conversely, for invalid usernames, the get password option/2() function in the ssh options module returns immediately. This discrepancy allows an attacker to distinguish between valid and invalid usernames in a single attempt.

Recommendations Update Erlang/OTP to version 29.0.2 or later. Update ssh to version 6.0.1 or later. Use the pwdfun option instead of user passwords for password authentication. Restrict SSH port access to trusted networks via firewall rules.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-48859

GHSA-3W6P-VWHF-WVP4

Affected Products

Erlang/Otp

Ssh

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-48859 · Security Note
• https://github.com/erlang/otp/security/advisories/GHSA-3w6p-vwhf-wvp4 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-48859 · Vendor Advisory
• https://github.com/erlang/otp/commit/c342092ef4b369bb409d5b71ac8fd83bab74aedf · Patch
• https://cna.erlef.org/cves/CVE-2026-48859.html · Note
• https://erlang.org/doc/system/versions.html#order-of-versions · Note