{"id":"CVE-2025-48041","aliases":["AZL-67121","AZL-67124","DEBIAN-CVE-2025-48041","DLA-4376-1","EEF-CVE-2025-48041","EUVD-2025-27676","GHSA-79c4-cvv7-4qm3","OESA-2026-1030","OESA-2026-1031","OESA-2026-3651","OESA-2026-3652","SUSE-SU-2025:3807-1","SUSE-SU-2025:4035-1","UBUNTU-CVE-2025-48041","USN-7831-1","openSUSE-SU-2025:15740-1"],"status":"published","title":"SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles","description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00391,"percentile":0.33547,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2025-09-11T08:14:20Z","modified":"2026-10-28T20:15:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"erlang","fixed_in":["25.3.2.21-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"erlang","fixed_in":["26.2.5.15-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"erlang","fixed_in":["1:25.2.3+dfsg-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"erlang","fixed_in":["1:27.3.4.1+dfsg-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"erlang","fixed_in":["1:27.3.4.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"erlang","fixed_in":["25.3.2.6-19.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"erlang","fixed_in":["25.3.2.6-19.oe2403sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server LTS 4.3","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"erlang","fixed_in":["23.3.4.19-150300.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"erlang26","fixed_in":["26.2.1-150300.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"erlang26","fixed_in":["26.2.1-150300.7.19.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"erlang26","fixed_in":["26.2.1-150300.7.19.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","fixed_in":["1:16.b.3-dfsg-1ubuntu2.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","fixed_in":["1:18.3-dfsg-1ubuntu3.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","fixed_in":["1:20.2.2+dfsg-1ubuntu2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","fixed_in":["1:22.2.7+dfsg-1ubuntu0.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"erlang","fixed_in":["1:24.2.1+dfsg-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"erlang","fixed_in":["1:25.3.2.8+dfsg-1ubuntu4.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"erlang","fixed_in":["1:27.3.4.1+dfsg-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.21-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.15-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.2.3+dfsg-1+deb12u4"}]}],"versions":["1:25.2.3+dfsg-1","1:25.2.3+dfsg-1+deb12u1","1:25.2.3+dfsg-1+deb12u2","1:25.2.3+dfsg-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.1+dfsg-1+deb13u1"}]}],"versions":["1:27.3.4.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.3+dfsg-1"}]}],"versions":["1:27.3.4.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:11","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.6+dfsg-1+deb11u3"}]}],"versions":["1:23.2.6+dfsg-1","1:23.2.6+dfsg-1+deb11u1","1:23.2.6+dfsg-1+deb11u2"],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.9-8.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.9-8.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-19.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-19.oe2403sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"erlang26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.1-150300.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"erlang26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.1-150300.7.19.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"erlang26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.1-150300.7.19.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2+esm1"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1","1:16.b.3-dfsg-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.3-dfsg-1ubuntu3.1+esm2"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3","1:18.3-dfsg-1ubuntu3.1","1:18.3-dfsg-1ubuntu3.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.2.2+dfsg-1ubuntu2+esm2"}]}],"versions":["1:20.0.4+dfsg-1ubuntu1","1:20.1.2+dfsg-1ubuntu1","1:20.1.3+dfsg-1ubuntu1","1:20.1.4+dfsg-1ubuntu1","1:20.1.5+dfsg-1ubuntu1","1:20.1.6+dfsg-1ubuntu1","1:20.1.7+dfsg-1ubuntu1","1:20.2.1+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu2","1:20.2.2+dfsg-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1ubuntu0.5+esm1"}]}],"versions":["1:22.0.7+dfsg-1build1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1","1:22.2.7+dfsg-1ubuntu0.2","1:22.2.7+dfsg-1ubuntu0.3","1:22.2.7+dfsg-1ubuntu0.4","1:22.2.7+dfsg-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.2.1+dfsg-1ubuntu0.6"}]}],"versions":["1:23.2.6+dfsg-1build1","1:24.1.1+dfsg-1","1:24.1.4+dfsg-1","1:24.1.5+dfsg-1","1:24.1.5+dfsg-1ubuntu1","1:24.2+dfsg-1","1:24.2.1+dfsg-1","1:24.2.1+dfsg-1ubuntu0.1","1:24.2.1+dfsg-1ubuntu0.2","1:24.2.1+dfsg-1ubuntu0.3","1:24.2.1+dfsg-1ubuntu0.4","1:24.2.1+dfsg-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.3.2.8+dfsg-1ubuntu4.5"}]}],"versions":["1:25.2.3+dfsg-1","1:25.3.2.8+dfsg-1","1:25.3.2.8+dfsg-1ubuntu1","1:25.3.2.8+dfsg-1ubuntu3","1:25.3.2.8+dfsg-1ubuntu4","1:25.3.2.8+dfsg-1ubuntu4.1","1:25.3.2.8+dfsg-1ubuntu4.2","1:25.3.2.8+dfsg-1ubuntu4.3","1:25.3.2.8+dfsg-1ubuntu4.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.1+dfsg-1ubuntu0.1"}]}],"versions":["1:27.3+dfsg-1ubuntu1","1:27.3+dfsg-1ubuntu1.1","1:27.3.4.1+dfsg-1","1:27.3.4.1+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2+esm1"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1","1:16.b.3-dfsg-1ubuntu2.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.3-dfsg-1ubuntu3.1+esm2"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3","1:18.3-dfsg-1ubuntu3.1","1:18.3-dfsg-1ubuntu3.1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.2.2+dfsg-1ubuntu2+esm2"}]}],"versions":["1:20.0.4+dfsg-1ubuntu1","1:20.1.2+dfsg-1ubuntu1","1:20.1.3+dfsg-1ubuntu1","1:20.1.4+dfsg-1ubuntu1","1:20.1.5+dfsg-1ubuntu1","1:20.1.6+dfsg-1ubuntu1","1:20.1.7+dfsg-1ubuntu1","1:20.2.1+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu2","1:20.2.2+dfsg-1ubuntu2+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1ubuntu0.5+esm1"}]}],"versions":["1:22.0.7+dfsg-1build1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1","1:22.2.7+dfsg-1ubuntu0.2","1:22.2.7+dfsg-1ubuntu0.3","1:22.2.7+dfsg-1ubuntu0.4","1:22.2.7+dfsg-1ubuntu0.5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.2.1+dfsg-1ubuntu0.6"}]}],"versions":["1:23.2.6+dfsg-1build1","1:24.1.1+dfsg-1","1:24.1.4+dfsg-1","1:24.1.5+dfsg-1","1:24.1.5+dfsg-1ubuntu1","1:24.2+dfsg-1","1:24.2.1+dfsg-1","1:24.2.1+dfsg-1ubuntu0.1","1:24.2.1+dfsg-1ubuntu0.2","1:24.2.1+dfsg-1ubuntu0.3","1:24.2.1+dfsg-1ubuntu0.4","1:24.2.1+dfsg-1ubuntu0.5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.3.2.8+dfsg-1ubuntu4.5"}]}],"versions":["1:25.2.3+dfsg-1","1:25.3.2.8+dfsg-1","1:25.3.2.8+dfsg-1ubuntu1","1:25.3.2.8+dfsg-1ubuntu3","1:25.3.2.8+dfsg-1ubuntu4","1:25.3.2.8+dfsg-1ubuntu4.1","1:25.3.2.8+dfsg-1ubuntu4.2","1:25.3.2.8+dfsg-1ubuntu4.3","1:25.3.2.8+dfsg-1ubuntu4.4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.1+dfsg-1ubuntu0.1"}]}],"versions":["1:27.3+dfsg-1ubuntu1","1:27.3+dfsg-1ubuntu1.1","1:27.3.4.1+dfsg-1","1:27.3.4.1+dfsg-1build1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"erlang27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1.3-1.1"}]}],"bundled":5}],"products":[{"vendor":"erlang","product":"otp"}],"references":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3","tags":["vendor-advisory","related","advisory","report"]},{"url":"https://cna.erlef.org/cves/CVE-2025-48041.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2025-48041","tags":["related","web"]},{"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions","tags":["x_version-scheme","web","report"]},{"url":"https://github.com/erlang/otp/pull/10157","tags":["patch","fix"]},{"url":"https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288","tags":["patch","fix"]},{"url":"https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401","tags":["patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48041","tags":["web","advisory"]},{"url":"https://github.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48041.json","tags":["advisory"]},{"url":"https://github.com/erlang/otp","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-48041","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1030","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48039","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1031","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3651","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3652","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253807-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249473","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48041","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254035-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-48041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48041","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7831-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-48038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-48039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-48040","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-48041","title":"SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles","description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.","status":"published","published":"2025-09-11T08:14:20.508Z","modified":"2026-07-24T14:14:04.956Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-770","CWE-400"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2025-27676","description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.","status":"published","published":"2025-09-11T08:14:20Z","modified":"2026-07-24T14:14:04Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:19:40.671085Z"}],"nvd":[{"id":"CVE-2025-48041","description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.","status":"published","published":"2025-09-11T09:15:34.603Z","modified":"2026-07-24T15:17:06.737Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:11:28.834562Z"}],"osv":[{"id":"CVE-2025-48041","title":"SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles","description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.","status":"published","published":"2025-09-11T08:14:20.508Z","modified":"2026-10-28T02:30:57.912143178Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-48041","description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.  This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.","status":"published","published":"2025-09-11T09:15:34.603Z","modified":"2026-09-01T20:05:53.069260656Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"EEF-CVE-2025-48041","title":"SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles","description":"## Summary\n\nAllocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh\\_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh\\_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.\n\n## Workarounds\n\n\\*  disabling SFTP\n  \\*  limiting number of max\\_sessions allowed for sshd, so exploiting becomes more complicated\n\n## Configurations\n\nThe SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting {subsystems, \\[\\]} in the SSH daemon configuration.","status":"published","published":"2025-09-11T08:14:20.508Z","modified":"2026-09-08T03:45:07.506155886Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770","CWE-400"],"updated_at":"2026-11-02T15:46:33.047032Z"},{"id":"OESA-2026-1030","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nAllocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48038)\n\nAllocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)\n\nAllocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)","status":"published","published":"2026-01-09T11:10:04Z","modified":"2026-08-18T01:19:25.941170862Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1031","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nAllocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48038)\n\nAllocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48039)\n\nAllocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)","status":"published","published":"2026-01-09T11:10:04Z","modified":"2026-08-18T01:19:26.346768033Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-3651","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nAllocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)","status":"published","published":"2026-09-05T15:03:31Z","modified":"2026-09-05T15:16:35.443762567Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3652","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nAllocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.(CVE-2025-48041)","status":"published","published":"2026-09-05T15:03:31Z","modified":"2026-09-05T15:16:37.132636572Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2025-48041","description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.","status":"published","published":"2025-09-11T09:15:00Z","modified":"2026-10-28T20:15:51.575657552Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-67121","title":"CVE-2025-48041 affecting package erlang for versions less than 25.3.2.21-4","description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.","status":"published","published":"2025-09-11T09:15:34Z","modified":"2026-04-21T04:38:04.823463Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"AZL-67124","title":"CVE-2025-48041 affecting package erlang for versions less than 26.2.5.15-1","description":"Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.","status":"published","published":"2025-09-11T09:15:34Z","modified":"2026-08-28T17:47:31.217956659Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"DLA-4376-1","title":"erlang - security update","status":"published","published":"2025-11-24T00:00:00Z","modified":"2025-11-24T17:32:40.577672Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"openSUSE-SU-2025:15740-1","title":"erlang27-27.1.3-1.1 on GA media","description":"These are all security issues fixed in the erlang27-27.1.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-18T00:00:00Z","modified":"2026-03-23T04:54:09.333733Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:3807-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\n  - CVE-2025-48041: fixed erlang exhaustion of file handles in SSH (bsc#1249473)\n","status":"published","published":"2025-10-27T12:58:41Z","modified":"2026-03-23T04:49:19.141722Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4035-1","title":"Security update for erlang26","description":"This update for erlang26 fixes the following issues:\n\n- CVE-2025-48041: Fixed exhaustion of file handles in ssh (bsc#1249473)\n","status":"published","published":"2025-11-10T13:47:05Z","modified":"2026-03-23T04:51:24.438607Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-7831-1","title":"erlang vulnerabilities","description":"It was discovered that Erlang incorrectly handled resource allocation and\nconsumption in the SFTP SSH module. An attacker could possibly use this\nissue cause Erlang to consume excessive resources, leading to a denial of\nservice.","status":"published","published":"2025-10-21T14:08:15Z","modified":"2026-06-25T13:32:31.469417148Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}