CVE-2025-48040
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In OTP SSH (ssh_sftp modules) before certain versions, there is an uncontrolled resource consumption vulnerability leading to excessive allocation and flooding. The vulnerability is in the file lib/ssh/src/ssh_sftpd.erl.
Risk Assessment
An attacker can overload the SSH server by sending specially crafted SFTP requests, leading to resource exhaustion and denial of service (DoS).
Recommendation
Update OTP to version 28.0.3, 27.3.4.3, or 26.2.5.15, depending on the branch used.
Original NVD description (English source)
Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.