CVE-2026-48859
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Erlang/OTP ssh (ssh_auth, ssh_options modules) has an observable timing discrepancy vulnerability. With user_passwords or password option enabled, password checking for valid usernames takes ~300ms, while for invalid ones ~0ms, allowing unauthenticated remote username enumeration.
Risk Assessment
An attacker can remotely determine valid SSH usernames, facilitating brute-force or phishing attacks. This could lead to unauthorized access to systems.
Recommendation
Update Erlang/OTP to version 29.0.2 or later (ssh 6.0.1). Use pwdfun instead of user_passwords/password options, which is not vulnerable.
Other vulnerabilities in Erlang/OTP ssh
See all- CVE-2026-54886Medium
An infinite loop vulnerability in the ssh_sftpd module of Erlang/OTP SSH allows an authenticated SFTP user to permanently block an SFTP channel. By sending extended data (SSH_MSG_CHANNEL_EXTENDED_DATA) with a non-zero type code, the attacker causes the handle_data/4 function to loop indefinitely, preventing further message processing on that channel.
- CVE-2026-53422Medium
A vulnerability in the ssh_sftpd module of the SSH server in OTP (Erlang) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The issue stems from improper path handling in the SSH_FXP_REALPATH handler, which does not canonicalize the path before checking restrictions.
- CVE-2026-32147Medium
A Path Traversal vulnerability in the ssh_sftpd module of Erlang OTP ssh allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.
Original NVD description (English source)
Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication. When the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh_options:get_password_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames. The user_passwords and password options are documented as intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability. This vulnerability is associated with program files lib/ssh/src/ssh_auth.erl and lib/ssh/src/ssh_options.erl. This issue affects OTP from OTP 29.0 before OTP 29.0.2, corresponding to ssh from 6.0 before 6.0.1.