Every CVE Search/ Get API key

CVE-2025-48040

Malicious Key Exchange Messages may Lead to Excessive Resource Consumption

6.9 MediumFix available

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.45%Up 0.4 points since Sep 11, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.9

Malicious Key Exchange Messages may Lead to Excessive Resource Consumption

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
CVE-2025-48040
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
EUVDEUVD-2025-27677 6.9

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
EUVD-2025-27677
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 6.9

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
CVE-2025-48040
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSV 6.9

Malicious Key Exchange Messages may Lead to Excessive Resource Consumption

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
CVE-2025-48040
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2025-48040 6.9

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
DEBIAN-CVE-2025-48040
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVEEF-CVE-2025-48040 6.9

Malicious Key Exchange Messages may Lead to Excessive Resource Consumption

Summary

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Workarounds

* set option parallel_login to false * reduce max_sessions option

Record
EEF-CVE-2025-48040
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
Show 12 moreShow less
OSVOESA-2026-1027 5.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48040)

Record
OESA-2026-1027
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1028 5.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48040)

Record
OESA-2026-1028
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1029 5.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48040)

Record
OESA-2026-1029
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1032 5.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48040)

Record
OESA-2026-1032
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2025-48040 6.9

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
UBUNTU-CVE-2025-48040
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-67278 No score

CVE-2025-48040 affecting package erlang for versions less than 25.3.2.21-4

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
AZL-67278
Updated
2026-11-02
OSVAZL-67293 No score

CVE-2025-48040 affecting package erlang for versions less than 26.2.5.15-1

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
AZL-67293
Updated
2026-11-02
OSVopenSUSE-SU-2026:20043-1 No score

Security update for erlang

This update for erlang fixes the following issues:

Update the ssh component to the latest in the maint-27 branch.

Security issues fixed:

  • CVE-2025-48040: ssh: overly tolerant handling of data received from unauthenticated users when processing key exchange messages may lead to excessive resource consumption (bsc#1249472).
  • CVE-2025-48039: ssh: unverified paths from authenticated SFTP users may lead to excessive resource consumption (bsc#1249469).
  • CVE-2025-48038: ssh: unverified file handles from authenticated SFTP users may lead to excessive resource consumption (bsc#1249470).
Record
openSUSE-SU-2026:20043-1
Updated
2026-11-02
OSVSUSE-SU-2026:0023-1 No score

Security update for erlang26

This update for erlang26 fixes the following issues:

  • CVE-2025-48040: Excessive resource consumption (bsc#1249472)
  • CVE-2025-48039: Excessive use of system resources (bsc#1249469)
  • CVE-2025-48038: Excessive use of system resources (bsc#1249470)
Record
SUSE-SU-2026:0023-1
Updated
2026-11-02
OSVSUSE-SU-2026:0661-1 No score

Security update for erlang

This update for erlang fixes the following issues:

  • CVE-2025-48039:Fixed an excessive use of system resources. (bsc#1249469)
  • CVE-2025-48038:Fixed an excessive use of system resources. (bsc#1249470)
  • CVE-2025-48040:Fixed an excessive resource consumption. (bsc#1249472)
Record
SUSE-SU-2026:0661-1
Updated
2026-11-02
OSVSUSE-SU-2026:20088-1 No score

Security update for erlang

This update for erlang fixes the following issues:

Update the ssh component to the latest in the maint-27 branch.

Security issues fixed:

  • CVE-2025-48040: ssh: overly tolerant handling of data received from unauthenticated users when processing key exchange messages may lead to excessive resource consumption (bsc#1249472).
  • CVE-2025-48039: ssh: unverified paths from authenticated SFTP users may lead to excessive resource consumption (bsc#1249469).
  • CVE-2025-48038: ssh: unverified file handles from authenticated SFTP users may lead to excessive resource consumption (bsc#1249470).
Record
SUSE-SU-2026:20088-1
Updated
2026-11-02
OSVUSN-7831-1 No score

erlang vulnerabilities

It was discovered that Erlang incorrectly handled resource allocation and consumption in the SFTP SSH module. An attacker could possibly use this issue cause Erlang to consume excessive resources, leading to a denial of service.

Record
USN-7831-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
erlang
Azure Linux:2
 before 25.3.2.21-4
25.3.2.21-4
erlang
Azure Linux:3
 before 26.2.5.15-1
26.2.5.15-1
erlang
Debian:12
 before 1:25.2.3+dfsg-1+deb12u4, plus listed versions
1:25.2.3+dfsg-11:25.2.3+dfsg-1+deb12u11:25.2.3+dfsg-1+deb12u21:25.2.3+dfsg-1+deb12u3
1:25.2.3+dfsg-1+deb12u4
erlang
Debian:13
 before 1:27.3.4.1+dfsg-1+deb13u1, plus listed versions
1:27.3.4.1+dfsg-1
1:27.3.4.1+dfsg-1+deb13u1
erlang
Debian:14
 before 1:27.3.4.3+dfsg-1, plus listed versions
1:27.3.4.1+dfsg-1
1:27.3.4.3+dfsg-1
erlang
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 25.3.2.6-11.oe2403sp1
25.3.2.6-11.oe2403sp1
erlang
openEuler:24.03-LTS-SP2
From an advisory covering 2 CVEs
 before 25.3.2.6-11.oe2403sp2
25.3.2.6-11.oe2403sp2
erlang
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 25.3.2.6-11.oe2403sp3
25.3.2.6-11.oe2403sp3
erlang
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 25.3.2.6-11.oe2403
25.3.2.6-11.oe2403
erlang26
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 3 CVEs
 before 26.2.1-150300.7.22.1
26.2.1-150300.7.22.1
Show 20 moreShow less
Affected packages
PackageAffectedFixed
erlang26
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 26.2.1-150300.7.22.1
26.2.1-150300.7.22.1
erlang
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 3 CVEs
 before 23.3.4.19-150300.3.29.1
23.3.4.19-150300.3.29.1
erlang
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 23.3.4.19-150300.3.29.1
23.3.4.19-150300.3.29.1
erlang
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 27.1.3-160000.3.1
27.1.3-160000.3.1
erlang
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 27.1.3-160000.3.1
27.1.3-160000.3.1
erlang
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu2
Show 5 moreShow less
1:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.21:16.b.3-dfsg-1ubuntu2.2+esm11:16.b.3-dfsg-1ubuntu2.2+esm21:16.b.3-dfsg-1ubuntu2.2+esm3
 None known
erlang
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu2
Show 6 moreShow less
1:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm11:18.3-dfsg-1ubuntu3.1+esm21:18.3-dfsg-1ubuntu3.1+esm31:18.3-dfsg-1ubuntu3.1+esm4
 None known
erlang
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 9 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm11:20.2.2+dfsg-1ubuntu2+esm21:20.2.2+dfsg-1ubuntu2+esm31:20.2.2+dfsg-1ubuntu2+esm4
 None known
erlang
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 10 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.51:22.2.7+dfsg-1ubuntu0.5+esm11:22.2.7+dfsg-1ubuntu0.5+esm21:22.2.7+dfsg-1ubuntu0.5+esm3
 None known
erlang
Ubuntu:22.04:LTS
 before 1:24.2.1+dfsg-1ubuntu0.6, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 7 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.5
1:24.2.1+dfsg-1ubuntu0.6
erlang
Ubuntu:24.04:LTS
 before 1:25.3.2.8+dfsg-1ubuntu4.5, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 4 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.4
1:25.3.2.8+dfsg-1ubuntu4.5
erlang
Ubuntu:25.10
 before 1:27.3.4.1+dfsg-1ubuntu0.1, plus listed versions
1:27.3+dfsg-1ubuntu11:27.3+dfsg-1ubuntu1.11:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1build1
1:27.3.4.1+dfsg-1ubuntu0.1
erlang
Ubuntu:Pro:14.04:LTS
From an advisory covering 4 CVEs
 before 1:16.b.3-dfsg-1ubuntu2.2+esm1, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu21:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.2
1:16.b.3-dfsg-1ubuntu2.2+esm1
erlang
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 1:18.3-dfsg-1ubuntu3.1+esm2, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu21:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm1
1:18.3-dfsg-1ubuntu3.1+esm2
erlang
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 1:20.2.2+dfsg-1ubuntu2+esm2, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 6 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm1
1:20.2.2+dfsg-1ubuntu2+esm2
erlang
Ubuntu:Pro:20.04:LTS
From an advisory covering 4 CVEs
 before 1:22.2.7+dfsg-1ubuntu0.5+esm1, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 7 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.5
1:22.2.7+dfsg-1ubuntu0.5+esm1
erlang
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 1:24.2.1+dfsg-1ubuntu0.6, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 7 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.5
1:24.2.1+dfsg-1ubuntu0.6
erlang
Ubuntu:24.04:LTS
From an advisory covering 4 CVEs
 before 1:25.3.2.8+dfsg-1ubuntu4.5, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 4 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.4
1:25.3.2.8+dfsg-1ubuntu4.5
erlang
Ubuntu:25.10
From an advisory covering 4 CVEs
 before 1:27.3.4.1+dfsg-1ubuntu0.1, plus listed versions
1:27.3+dfsg-1ubuntu11:27.3+dfsg-1ubuntu1.11:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1build1
1:27.3.4.1+dfsg-1ubuntu0.1
erlang
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 27.1.3-160000.3.1
27.1.3-160000.3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-48040 is a medium vulnerability (CVSS 6.9) in Erlang Otp, published September 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in erlang 25.3.2.21-4.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open