Every CVE Search/ Get API key

CVE-2025-48041

SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

7.1 HighFix available

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.39%Up 0.3 points since Sep 11, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.1

SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
CVE-2025-48041
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770, CWE-400
Updated
2026-11-02
EUVDEUVD-2025-27676 7.1

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
EUVD-2025-27676
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 7.1

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
CVE-2025-48041
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSV 7.1

SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
CVE-2025-48041
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2025-48041 7.1

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
DEBIAN-CVE-2025-48041
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVEEF-CVE-2025-48041 7.1

SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

Summary

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Workarounds

* disabling SFTP * limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated

Configurations

The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting {subsystems, []} in the SSH daemon configuration.

Record
EEF-CVE-2025-48041
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770, CWE-400
Updated
2026-11-02
Show 11 moreShow less
OSVOESA-2026-1030 4.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48038)

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)

Record
OESA-2026-1030
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1031 4.3

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48038)

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)

Record
OESA-2026-1031
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-3651 7.1

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)

Record
OESA-2026-3651
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-3652 7.1

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)

Record
OESA-2026-3652
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-48041 7.1

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
UBUNTU-CVE-2025-48041
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-67121 No score

CVE-2025-48041 affecting package erlang for versions less than 25.3.2.21-4

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
AZL-67121
Updated
2026-11-02
OSVAZL-67124 No score

CVE-2025-48041 affecting package erlang for versions less than 26.2.5.15-1

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Record
AZL-67124
Updated
2026-11-02
OSVopenSUSE-SU-2025:15740-1 No score

erlang27-27.1.3-1.1 on GA media

These are all security issues fixed in the erlang27-27.1.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15740-1
Updated
2026-11-02
OSVSUSE-SU-2025:3807-1 No score

Security update for erlang

This update for erlang fixes the following issues:

  • CVE-2025-48041: fixed erlang exhaustion of file handles in SSH (bsc#1249473)
Record
SUSE-SU-2025:3807-1
Updated
2026-11-02
OSVSUSE-SU-2025:4035-1 No score

Security update for erlang26

This update for erlang26 fixes the following issues:

  • CVE-2025-48041: Fixed exhaustion of file handles in ssh (bsc#1249473)
Record
SUSE-SU-2025:4035-1
Updated
2026-11-02
OSVUSN-7831-1 No score

erlang vulnerabilities

It was discovered that Erlang incorrectly handled resource allocation and consumption in the SFTP SSH module. An attacker could possibly use this issue cause Erlang to consume excessive resources, leading to a denial of service.

Record
USN-7831-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
erlang
Azure Linux:2
 before 25.3.2.21-4
25.3.2.21-4
erlang
Azure Linux:3
 before 26.2.5.15-1
26.2.5.15-1
erlang
Debian:12
 before 1:25.2.3+dfsg-1+deb12u4, plus listed versions
1:25.2.3+dfsg-11:25.2.3+dfsg-1+deb12u11:25.2.3+dfsg-1+deb12u21:25.2.3+dfsg-1+deb12u3
1:25.2.3+dfsg-1+deb12u4
erlang
Debian:13
 before 1:27.3.4.1+dfsg-1+deb13u1, plus listed versions
1:27.3.4.1+dfsg-1
1:27.3.4.1+dfsg-1+deb13u1
erlang
Debian:14
 before 1:27.3.4.3+dfsg-1, plus listed versions
1:27.3.4.1+dfsg-1
1:27.3.4.3+dfsg-1
erlang
Debian:11
From an advisory covering 4 CVEs
 before 1:23.2.6+dfsg-1+deb11u3, plus listed versions
1:23.2.6+dfsg-11:23.2.6+dfsg-1+deb11u11:23.2.6+dfsg-1+deb11u2
1:23.2.6+dfsg-1+deb11u3
erlang
openEuler:22.03-LTS-SP3
From an advisory covering 3 CVEs
 before 23.3.4.9-8.oe2203sp3
23.3.4.9-8.oe2203sp3
erlang
openEuler:22.03-LTS-SP4
From an advisory covering 3 CVEs
 before 23.3.4.9-8.oe2203sp4
23.3.4.9-8.oe2203sp4
erlang
openEuler:24.03-LTS-SP1
 before 25.3.2.6-19.oe2403sp1
25.3.2.6-19.oe2403sp1
erlang
openEuler:24.03-LTS-SP3
 before 25.3.2.6-19.oe2403sp3
25.3.2.6-19.oe2403sp3
Show 35 moreShow less
Affected packages
PackageAffectedFixed
erlang
SUSE:Linux Enterprise Module for Server Applications 15 SP6
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Manager Proxy LTS 4.3
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Manager Server LTS 4.3
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
SUSE:Enterprise Storage 7.1
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang
openSUSE:Leap 15.6
 before 23.3.4.19-150300.3.26.1
23.3.4.19-150300.3.26.1
erlang26
SUSE:Linux Enterprise Module for Server Applications 15 SP6
 before 26.2.1-150300.7.19.1
26.2.1-150300.7.19.1
erlang26
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 26.2.1-150300.7.19.1
26.2.1-150300.7.19.1
erlang26
openSUSE:Leap 15.6
 before 26.2.1-150300.7.19.1
26.2.1-150300.7.19.1
erlang
Ubuntu:Pro:14.04:LTS
 before 1:16.b.3-dfsg-1ubuntu2.2+esm1, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu21:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.2
1:16.b.3-dfsg-1ubuntu2.2+esm1
erlang
Ubuntu:Pro:16.04:LTS
 before 1:18.3-dfsg-1ubuntu3.1+esm2, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu21:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm1
1:18.3-dfsg-1ubuntu3.1+esm2
erlang
Ubuntu:Pro:18.04:LTS
 before 1:20.2.2+dfsg-1ubuntu2+esm2, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 6 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm1
1:20.2.2+dfsg-1ubuntu2+esm2
erlang
Ubuntu:Pro:20.04:LTS
 before 1:22.2.7+dfsg-1ubuntu0.5+esm1, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 7 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.5
1:22.2.7+dfsg-1ubuntu0.5+esm1
erlang
Ubuntu:22.04:LTS
 before 1:24.2.1+dfsg-1ubuntu0.6, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 7 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.5
1:24.2.1+dfsg-1ubuntu0.6
erlang
Ubuntu:24.04:LTS
 before 1:25.3.2.8+dfsg-1ubuntu4.5, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 4 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.4
1:25.3.2.8+dfsg-1ubuntu4.5
erlang
Ubuntu:25.10
 before 1:27.3.4.1+dfsg-1ubuntu0.1, plus listed versions
1:27.3+dfsg-1ubuntu11:27.3+dfsg-1ubuntu1.11:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1build1
1:27.3.4.1+dfsg-1ubuntu0.1
erlang
Ubuntu:Pro:14.04:LTS
From an advisory covering 4 CVEs
 before 1:16.b.3-dfsg-1ubuntu2.2+esm1, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu21:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.2
1:16.b.3-dfsg-1ubuntu2.2+esm1
erlang
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 1:18.3-dfsg-1ubuntu3.1+esm2, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu21:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm1
1:18.3-dfsg-1ubuntu3.1+esm2
erlang
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 1:20.2.2+dfsg-1ubuntu2+esm2, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 6 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm1
1:20.2.2+dfsg-1ubuntu2+esm2
erlang
Ubuntu:Pro:20.04:LTS
From an advisory covering 4 CVEs
 before 1:22.2.7+dfsg-1ubuntu0.5+esm1, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 7 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.5
1:22.2.7+dfsg-1ubuntu0.5+esm1
erlang
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 1:24.2.1+dfsg-1ubuntu0.6, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 7 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.5
1:24.2.1+dfsg-1ubuntu0.6
erlang
Ubuntu:24.04:LTS
From an advisory covering 4 CVEs
 before 1:25.3.2.8+dfsg-1ubuntu4.5, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 4 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.4
1:25.3.2.8+dfsg-1ubuntu4.5
erlang
Ubuntu:25.10
From an advisory covering 4 CVEs
 before 1:27.3.4.1+dfsg-1ubuntu0.1, plus listed versions
1:27.3+dfsg-1ubuntu11:27.3+dfsg-1ubuntu1.11:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1build1
1:27.3.4.1+dfsg-1ubuntu0.1
erlang27
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 27.1.3-1.1
27.1.3-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-48041 is a high vulnerability (CVSS 7.1) in Erlang Otp, published September 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in erlang 25.3.2.21-4.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open