Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade erlang | Aug 8, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade erlang | Apr 21, 2025 | Apr 16, 2025 |
| Freebsd | — | Upgrade erlang-runtime24Upgrade erlangUpgrade erlang-runtime27Upgrade erlang-runtime26Upgrade erlang-runtime22Upgrade erlang-runtime23Upgrade erlang-runtime25Upgrade erlang-runtime21 | Apr 22, 2025 | Apr 20, 2025 |
| Suse | — | Upgrade erlang-observer-srcUpgrade erlang-debuggerUpgrade erlang26-diameter-srcUpgrade erlang-wxUpgrade erlang-wx-srcUpgrade erlang-et-srcUpgrade erlang26-diameterUpgrade erlang-observerUpgrade erlang26-etUpgrade erlang26-wx-srcUpgrade erlang26-dialyzerUpgrade erlang-debugger-srcUpgrade erlang26-debuggerUpgrade erlang26-epmdUpgrade erlang26-docUpgrade erlangUpgrade erlang-srcUpgrade erlang26-srcUpgrade erlang-jinterfaceUpgrade erlang26-jinterfaceUpgrade erlang26-reltool-srcUpgrade erlang-jinterface-srcUpgrade erlang-etUpgrade erlang26-et-srcUpgrade erlang26-wxUpgrade erlang26Upgrade erlang-docUpgrade erlang-diameterUpgrade erlang26-observer-srcUpgrade erlang26-debugger-srcUpgrade erlang-reltoolUpgrade erlang-epmdUpgrade erlang26-observerUpgrade erlang-reltool-srcUpgrade erlang26-dialyzer-srcUpgrade erlang-dialyzer-srcUpgrade erlang-dialyzerUpgrade erlang26-reltoolUpgrade erlang-diameter-srcUpgrade erlang26-jinterface-src | Dec 5, 2025 | Apr 22, 2025 |
| Ubuntu | — | Upgrade erlang (Ubuntu Pro)Upgrade erlangUpgrade erlang-sshUpgrade erlang-ssh (Ubuntu Pro) | Apr 21, 2025 | Apr 16, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub