CVE-2025-48041 — Uncontrolled Resource Consumption in OTP

CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation of Resources Without Limits or Throttling7 documents7 sources
Severity
7.1HIGHNVD
EPSS
0.2%
top 63.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Erlang OTP
Timeline
PublishedSep 11
Latest updateOct 21

Description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5erlang/otp3.0.1 — *+2

🔴Vulnerability Details

2
OSV
CVE-2025-48041: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding↗2025-09-11
▶
CVEList
SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles↗2025-09-11
▶

📋Vendor Advisories

4
Ubuntu
Erlang vulnerabilities↗2025-10-21
▶
Red Hat
erlang: Erlang Exhaustion of File Handles↗2025-09-11
▶
Microsoft
SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles↗2025-09-09
▶
Debian
CVE-2025-48041: erlang - Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP...↗2025
▶
CVE-2025-48041 — Uncontrolled Resource Consumption | cvebase