6.9
CVE-2025-48040
- EPSS 0.4%
- Veröffentlicht 11.09.2025 08:14:19
- Zuletzt bearbeitet 05.06.2026 13:16:33
- Quelle 6b3ad84c-e1a6-4bf7-a703-f496b7
- CVE-Watchlists
- Unerledigt
Malicious Key Exchange Messages may Lead to Excessive Resource Consumption
Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerErlang
≫
Produkt
OTP
Default Statusunknown
Version
3.0.1
Version <
*
Status
affected
HerstellerErlang
≫
Produkt
OTP
Default Statusunknown
Version
17.0
Version <
*
Status
affected
Version
07b8f441ca711f9812fad9e9115bab3c3aa92f79
Version <
*
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.4% | 0.318 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | 6.9 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-400 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
https://www.erlang.org/doc/system/versions.html#order-of-versions
https://github.com/erlang/otp/security/advisories/GHSA-h7rg-6rjg-4cph
https://github.com/erlang/otp/pull/10162
https://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a
https://github.com/erlang/otp/commit/548f1295d86d0803da884db8685cc16d461d0d5a
https://cna.erlef.org/cves/CVE-2025-48040.html
https://osv.dev/vulnerability/EEF-CVE-2025-48040