CVE-2025-48039
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The ssh_sftp module in Erlang OTP before OTP 28.0.3, 27.3.4.3, and 26.2.5.15 does not limit resource allocation, allowing excessive allocation and resource leak. The vulnerability is in lib/ssh/src/ssh_sftpd.erl.
Risk Assessment
An attacker can cause memory or other server resource exhaustion, leading to denial of service (DoS).
Recommendation
Update Erlang OTP to versions OTP 28.0.3, 27.3.4.3, or 26.2.5.15, which include the allocation limiting fix.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.