Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.
This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.
CVSS Details
- CVSS 4.0 Base Score: 7.1 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade erlang | Nov 26, 2025 | Nov 26, 2025 |
| Suse | — | Upgrade erlang-etUpgrade erlang-jinterfaceUpgrade erlang26Upgrade erlang-jinterface-srcUpgrade erlang-diameter-srcUpgrade erlang26-observerUpgrade erlang26-observer-srcUpgrade erlang-reltoolUpgrade erlang26-et-srcUpgrade erlang26-dialyzer-srcUpgrade erlang-et-srcUpgrade erlang-epmdUpgrade erlang26-debugger-srcUpgrade erlang26-wxUpgrade erlang-docUpgrade erlang26-jinterface-srcUpgrade erlang-diameterUpgrade erlang-dialyzerUpgrade erlang26-reltoolUpgrade erlang26-jinterfaceUpgrade erlang-dialyzer-srcUpgrade erlang-observer-srcUpgrade erlang-debugger-srcUpgrade erlang-observerUpgrade erlang-debuggerUpgrade erlang26-diameter-srcUpgrade erlang26-diameterUpgrade erlang-wx-srcUpgrade erlang26-srcUpgrade erlang26-epmdUpgrade erlang-reltool-srcUpgrade erlang-wxUpgrade erlangUpgrade erlang26-dialyzerUpgrade erlang26-wx-srcUpgrade erlang26-docUpgrade erlang-srcUpgrade erlang26-et | Dec 5, 2025 | Oct 27, 2025 |
| Ubuntu | — | Upgrade erlang-ssh (Ubuntu Pro)Upgrade erlang (Ubuntu Pro)Upgrade erlang-sshUpgrade erlang | Oct 22, 2025 | Sep 11, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 17, 2025 | Sep 11, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub