Description
Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.
Published: 2025-09-11
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in Erlang/OTP SSH’s sftp module (ssh_sftpd.erl), where it improperly allocates memory during key exchange handling. An attacker can exploit this behavior by sending malformed or repeated key‑exchange messages, causing excessive allocation and flooding the daemon’s resources. The resulting denial of service can manifest as degraded performance or crashes for users connected to the affected SSH service. This weakness corresponds to CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Excessive Allocation).

Affected Systems

The vulnerability is present in Erlang/OTP releases from version 17.0 up to and including 28.0.3 and also in OTP 27.3.4.3 and OTP 26.2.5.15. The affected SSH/​SFTP binaries correspond to versions 3.0.1 through 5.3.3, 5.2.11.3 and 5.1.4.12, respectively. Administrators running an SSH server built on these OTP releases should verify that they are not operating within this affected range.

Risk and Exploitability

The CVSS base score of 6.9 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but a potential attacker could initiate many concurrent SSH sessions that force the daemon to perform excessive memory allocation and surface resource exhaustion, leading to service degradation or crash. Adopting the official fix in newer OTP releases is the recommended remediation; in the meantime, disabling parallel logins and reducing the maximum allowed sessions mitigates the impact.

Generated by OpenCVE AI on August 3, 2026 at 08:24 UTC.

Remediation

Vendor Workaround

* set option parallel_login to false * reduce max_sessions option

OpenCVE Recommended Actions

  • Upgrade Erlang/OTP to a release that includes the ssh_sftpd resource‑management fix.
  • Configure the SSH daemon to set the parallel_login option to false, preventing simultaneous authentication attempts.
  • Reduce the max_sessions setting to limit the number of concurrent SSH sessions a user may open.

Generated by OpenCVE AI on August 3, 2026 at 08:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-27677 Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
History

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12. Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Fri, 05 Jun 2026 12:45:00 +0000

Type Values Removed Values Added
Description Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12. Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
References

Fri, 12 Sep 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Moderate

Fri, 12 Sep 2025 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Erlang otp
Vendors & Products Erlang otp

Thu, 11 Sep 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 11 Sep 2025 08:30:00 +0000

Type Values Removed Values Added
Description Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
Title Malicious Key Exchange Messages may Lead to Excessive Resource Consumption
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-400
CWE-770
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang\/otp Otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-07-24T14:14:06.640Z

Reserved: 2025-05-15T08:40:25.455Z

Link: CVE-2025-48040

cve-icon Vulnrichment

Updated: 2025-09-11T13:30:37.281Z

cve-icon NVD

Status : Deferred

Published: 2025-09-11T09:15:34.400

Modified: 2026-06-17T09:29:03.090

Link: CVE-2025-48040

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-09-11T08:14:19Z

Links: CVE-2025-48040 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T08:30:17Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling