Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade erlang | Apr 21, 2025 | Mar 28, 2025 |
| Suse | — | Upgrade erlang26-diameterUpgrade erlang26-dialyzerUpgrade erlang26-epmdUpgrade erlang26-observer-srcUpgrade erlang26-diameter-srcUpgrade erlang26Upgrade erlang26-wx-srcUpgrade erlang26-debuggerUpgrade erlang26-jinterfaceUpgrade erlang26-srcUpgrade erlang26-debugger-srcUpgrade erlang26-reltoolUpgrade erlang26-dialyzer-srcUpgrade erlang26-etUpgrade erlang26-reltool-srcUpgrade erlang26-wxUpgrade erlang26-docUpgrade erlang26-et-srcUpgrade erlang26-observerUpgrade erlang26-jinterface-src | Dec 5, 2025 | Apr 22, 2025 |
| Ubuntu | — | Upgrade erlangUpgrade erlang-ssh | Apr 9, 2025 | Mar 28, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 28, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub