Every CVE Search/ Get API key

CVE-2025-48039

Unverified Paths can Cause Excessive Use of System Resources

5.3 MediumFix available

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.39%Up 0.3 points since Sep 11, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.3

Unverified Paths can Cause Excessive Use of System Resources

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
CVE-2025-48039
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-770, CWE-400
Updated
2026-11-02
EUVDEUVD-2025-27678 5.3

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
EUVD-2025-27678
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 5.3

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
CVE-2025-48039
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSV 5.3

Unverified Paths can Cause Excessive Use of System Resources

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
CVE-2025-48039
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2025-48039 5.3

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
DEBIAN-CVE-2025-48039
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVEEF-CVE-2025-48039 5.3

Unverified Paths can Cause Excessive Use of System Resources

Summary

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Workarounds

* Disable sftp * limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated

Configurations

The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting {subsystems, []} in the SSH daemon configuration.

Record
EEF-CVE-2025-48039
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-770, CWE-400
Updated
2026-11-02
Show 15 moreShow less
OSVOESA-2026-1027 5.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48040)

Record
OESA-2026-1027
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1028 5.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48040)

Record
OESA-2026-1028
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1029 5.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48040)

Record
OESA-2026-1029
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1030 4.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48038)

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)

Record
OESA-2026-1030
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1031 4.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48038)

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)

Record
OESA-2026-1031
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1032 5.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48040)

Record
OESA-2026-1032
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2025-48039 5.3

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
UBUNTU-CVE-2025-48039
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-67127 No score

CVE-2025-48039 affecting package erlang for versions less than 26.2.5.15-1

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
AZL-67127
Updated
2026-11-02
OSVAZL-67130 No score

CVE-2025-48039 affecting package erlang for versions less than 25.3.2.21-4

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
AZL-67130
Updated
2026-11-02
OSVopenSUSE-SU-2026:10947-1 No score

erlang27-27.1.3-2.1 on GA media

These are all security issues fixed in the erlang27-27.1.3-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10947-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20043-1 No score

Security update for erlang

This update for erlang fixes the following issues:

Update the ssh component to the latest in the maint-27 branch.

Security issues fixed:

  • CVE-2025-48040: ssh: overly tolerant handling of data received from unauthenticated users when processing key exchange messages may lead to excessive resource consumption (bsc#1249472).
  • CVE-2025-48039: ssh: unverified paths from authenticated SFTP users may lead to excessive resource consumption (bsc#1249469).
  • CVE-2025-48038: ssh: unverified file handles from authenticated SFTP users may lead to excessive resource consumption (bsc#1249470).
Record
openSUSE-SU-2026:20043-1
Updated
2026-11-02
OSVSUSE-SU-2026:0023-1 No score

Security update for erlang26

This update for erlang26 fixes the following issues:

  • CVE-2025-48040: Excessive resource consumption (bsc#1249472)
  • CVE-2025-48039: Excessive use of system resources (bsc#1249469)
  • CVE-2025-48038: Excessive use of system resources (bsc#1249470)
Record
SUSE-SU-2026:0023-1
Updated
2026-11-02
OSVSUSE-SU-2026:0661-1 No score

Security update for erlang

This update for erlang fixes the following issues:

  • CVE-2025-48039:Fixed an excessive use of system resources. (bsc#1249469)
  • CVE-2025-48038:Fixed an excessive use of system resources. (bsc#1249470)
  • CVE-2025-48040:Fixed an excessive resource consumption. (bsc#1249472)
Record
SUSE-SU-2026:0661-1
Updated
2026-11-02
OSVSUSE-SU-2026:20088-1 No score

Security update for erlang

This update for erlang fixes the following issues:

Update the ssh component to the latest in the maint-27 branch.

Security issues fixed:

  • CVE-2025-48040: ssh: overly tolerant handling of data received from unauthenticated users when processing key exchange messages may lead to excessive resource consumption (bsc#1249472).
  • CVE-2025-48039: ssh: unverified paths from authenticated SFTP users may lead to excessive resource consumption (bsc#1249469).
  • CVE-2025-48038: ssh: unverified file handles from authenticated SFTP users may lead to excessive resource consumption (bsc#1249470).
Record
SUSE-SU-2026:20088-1
Updated
2026-11-02
OSVUSN-7831-1 No score

erlang vulnerabilities

It was discovered that Erlang incorrectly handled resource allocation and consumption in the SFTP SSH module. An attacker could possibly use this issue cause Erlang to consume excessive resources, leading to a denial of service.

Record
USN-7831-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
erlang
Azure Linux:3
 before 26.2.5.15-1
26.2.5.15-1
erlang
Azure Linux:2
 before 25.3.2.21-4
25.3.2.21-4
erlang
Debian:12
 before 1:25.2.3+dfsg-1+deb12u4, plus listed versions
1:25.2.3+dfsg-11:25.2.3+dfsg-1+deb12u11:25.2.3+dfsg-1+deb12u21:25.2.3+dfsg-1+deb12u3
1:25.2.3+dfsg-1+deb12u4
erlang
Debian:13
 before 1:27.3.4.1+dfsg-1+deb13u1, plus listed versions
1:27.3.4.1+dfsg-1
1:27.3.4.1+dfsg-1+deb13u1
erlang
Debian:14
 before 1:27.3.4.3+dfsg-1, plus listed versions
1:27.3.4.1+dfsg-1
1:27.3.4.3+dfsg-1
erlang
Debian:11
From an advisory covering 4 CVEs
 before 1:23.2.6+dfsg-1+deb11u3, plus listed versions
1:23.2.6+dfsg-11:23.2.6+dfsg-1+deb11u11:23.2.6+dfsg-1+deb11u2
1:23.2.6+dfsg-1+deb11u3
erlang
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 25.3.2.6-11.oe2403sp1
25.3.2.6-11.oe2403sp1
erlang
openEuler:24.03-LTS-SP2
From an advisory covering 2 CVEs
 before 25.3.2.6-11.oe2403sp2
25.3.2.6-11.oe2403sp2
erlang
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 25.3.2.6-11.oe2403sp3
25.3.2.6-11.oe2403sp3
erlang
openEuler:22.03-LTS-SP3
From an advisory covering 3 CVEs
 before 23.3.4.9-8.oe2203sp3
23.3.4.9-8.oe2203sp3
Show 24 moreShow less
Affected packages
PackageAffectedFixed
erlang
openEuler:22.03-LTS-SP4
From an advisory covering 3 CVEs
 before 23.3.4.9-8.oe2203sp4
23.3.4.9-8.oe2203sp4
erlang
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 25.3.2.6-11.oe2403
25.3.2.6-11.oe2403
erlang26
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 3 CVEs
 before 26.2.1-150300.7.22.1
26.2.1-150300.7.22.1
erlang26
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 26.2.1-150300.7.22.1
26.2.1-150300.7.22.1
erlang
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 3 CVEs
 before 23.3.4.19-150300.3.29.1
23.3.4.19-150300.3.29.1
erlang
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 23.3.4.19-150300.3.29.1
23.3.4.19-150300.3.29.1
erlang
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 27.1.3-160000.3.1
27.1.3-160000.3.1
erlang
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 27.1.3-160000.3.1
27.1.3-160000.3.1
erlang
Ubuntu:Pro:14.04:LTS
 before 1:16.b.3-dfsg-1ubuntu2.2+esm1, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu21:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.2
1:16.b.3-dfsg-1ubuntu2.2+esm1
erlang
Ubuntu:Pro:16.04:LTS
 before 1:18.3-dfsg-1ubuntu3.1+esm2, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu21:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm1
1:18.3-dfsg-1ubuntu3.1+esm2
erlang
Ubuntu:Pro:18.04:LTS
 before 1:20.2.2+dfsg-1ubuntu2+esm2, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 6 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm1
1:20.2.2+dfsg-1ubuntu2+esm2
erlang
Ubuntu:Pro:20.04:LTS
 before 1:22.2.7+dfsg-1ubuntu0.5+esm1, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 7 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.5
1:22.2.7+dfsg-1ubuntu0.5+esm1
erlang
Ubuntu:22.04:LTS
 before 1:24.2.1+dfsg-1ubuntu0.6, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 7 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.5
1:24.2.1+dfsg-1ubuntu0.6
erlang
Ubuntu:24.04:LTS
 before 1:25.3.2.8+dfsg-1ubuntu4.5, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 4 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.4
1:25.3.2.8+dfsg-1ubuntu4.5
erlang
Ubuntu:25.10
 before 1:27.3.4.1+dfsg-1ubuntu0.1, plus listed versions
1:27.3+dfsg-1ubuntu11:27.3+dfsg-1ubuntu1.11:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1build1
1:27.3.4.1+dfsg-1ubuntu0.1
erlang
Ubuntu:Pro:14.04:LTS
From an advisory covering 4 CVEs
 before 1:16.b.3-dfsg-1ubuntu2.2+esm1, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu21:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.2
1:16.b.3-dfsg-1ubuntu2.2+esm1
erlang
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 1:18.3-dfsg-1ubuntu3.1+esm2, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu21:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm1
1:18.3-dfsg-1ubuntu3.1+esm2
erlang
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 1:20.2.2+dfsg-1ubuntu2+esm2, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 6 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm1
1:20.2.2+dfsg-1ubuntu2+esm2
erlang
Ubuntu:Pro:20.04:LTS
From an advisory covering 4 CVEs
 before 1:22.2.7+dfsg-1ubuntu0.5+esm1, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 7 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.5
1:22.2.7+dfsg-1ubuntu0.5+esm1
erlang
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 1:24.2.1+dfsg-1ubuntu0.6, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 7 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.5
1:24.2.1+dfsg-1ubuntu0.6
erlang
Ubuntu:24.04:LTS
From an advisory covering 4 CVEs
 before 1:25.3.2.8+dfsg-1ubuntu4.5, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 4 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.4
1:25.3.2.8+dfsg-1ubuntu4.5
erlang
Ubuntu:25.10
From an advisory covering 4 CVEs
 before 1:27.3.4.1+dfsg-1ubuntu0.1, plus listed versions
1:27.3+dfsg-1ubuntu11:27.3+dfsg-1ubuntu1.11:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1build1
1:27.3.4.1+dfsg-1ubuntu0.1
erlang27
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 27.1.3-2.1
27.1.3-2.1
erlang
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 27.1.3-160000.3.1
27.1.3-160000.3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-48039 is a medium vulnerability (CVSS 5.3) in Erlang Otp, published September 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in erlang 26.2.5.15-1.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open