CVE-2026-48858
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
SSRF vulnerability in Erlang/OTP FTP module allows an attacker to redirect the data connection to any internal host and port via an unvalidated PASV response. The flaw exists in the default configuration (passive mode, IPv4, no FTP extensions) and enables FTP bounce attacks and internal network scanning.
Risk Assessment
The organization is at risk of unauthorized access to internal resources, including cloud metadata endpoints, and data exfiltration to third-party hosts, potentially leading to data breaches and system compromise.
Recommendation
Immediately upgrade Erlang/OTP to version OTP 29.0.2, OTP 28.5.0.2, or OTP 27.3.4.13, depending on the branch in use. If not possible, consider disabling or replacing the deprecated ftp application.
Other vulnerabilities in Erlang/OTP
See all- CVE-2026-28808Critical
In Erlang OTP (inets module), an incorrect authorization vulnerability exists. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory access controls against the DocumentRoot path while mod_cgi executes the script at the ScriptAlias path. This mismatch allows unauthenticated access to CGI scripts protected by directory rules.
- CVE-2026-23941Critical
In Erlang OTP (inets httpd module), an HTTP Request Smuggling vulnerability exists. The server does not reject or normalize duplicate Content-Length headers. The first value is used, while common proxies use the last, enabling front-end/back-end desynchronization and injection of attacker-controlled bytes as the start of the next request.
- CVE-2016-10253Critical
An issue was discovered in Erlang/OTP 18.x related to the generation of compiled regular expressions, which is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset used as an array index.
- CVE-2026-58227High
A vulnerability in the Erlang/OTP SSL application allows memory exhaustion by sending a crafted certificate chain during TLS/DTLS handshake. Lack of cycle detection in the certificate chain building function causes unbounded recursion, leading to BEAM node crash.
- CVE-2026-55953High
The TLS 1.2 (and earlier) and DTLS client in Erlang/OTP does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client. An on-path attacker can select an anonymous cipher suite, bypassing certificate and hostname verification, allowing interception and modification of traffic.
- CVE-2026-55737High
In Erlang OTP, a signed to unsigned conversion error and out-of-bounds heap write vulnerability exists when decoding a crafted ETF binary via binary_to_term/1. This can corrupt the BEAM heap pointer and crash the virtual machine.
- CVE-2026-54890High
A vulnerability in the External Term Format (ETF) decoder in ERTS causes an integer underflow when processing crafted binary data. This leads to allocating huge memory and crashing the entire Erlang/VM node.
- CVE-2026-47078Medium
In the zip module of Erlang OTP stdlib, a relative path traversal vulnerability allows writing files outside the intended extraction directory via a crafted zip archive. The zip:check_dir_level/2 function improperly validates paths containing ../ sequences.
- CVE-2026-42792High
In Erlang OTP (epmd), a connection slot exhaustion vulnerability allows an unauthenticated remote attacker to permanently terminate the epmd daemon. The do_accept function incorrectly treats EMFILE/ENFILE errors as fatal instead of recoverable.
- CVE-2026-55952High
Vulnerability in the Erlang/OTP ssl application. An unauthenticated attacker can send a crafted TLS 1.3 ClientHello, crashing the session ticket handler and making TLS 1.3 unusable until the ssl application is restarted.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts. The vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer. The ftp application is deprecated and scheduled for removal in OTP-30. This vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP 21.0 and later). This issue affects OTP from OTP 17.4 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to inets from 5.10.4 before 7.0 and ftp from 1.0 before 1.2.6, 1.2.4.1 and 1.2.3.1.