Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.
This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.
CVSS Details
- CVSS 4.0 Base Score: 7.1 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade erlang | Nov 26, 2025 | Nov 26, 2025 |
| Suse | — | Upgrade erlang-epmdUpgrade erlang26-observerUpgrade erlang26-etUpgrade erlang-debuggerUpgrade erlang-observer-srcUpgrade erlang-observerUpgrade erlang-srcUpgrade erlang26-diameter-srcUpgrade erlang-debugger-srcUpgrade erlang26-dialyzerUpgrade erlang26-docUpgrade erlang-wxUpgrade erlang-wx-srcUpgrade erlang26-diameterUpgrade erlangUpgrade erlang26-srcUpgrade erlang26-wx-srcUpgrade erlang-jinterface-srcUpgrade erlang-diameter-srcUpgrade erlang-reltoolUpgrade erlang26-et-srcUpgrade erlang26-reltoolUpgrade erlang26-wxUpgrade erlang26-reltool-srcUpgrade erlang26-dialyzer-srcUpgrade erlang-et-srcUpgrade erlang26Upgrade erlang26-observer-srcUpgrade erlang26-debuggerUpgrade erlang-jinterfaceUpgrade erlang-etUpgrade erlang-dialyzer-srcUpgrade erlang-dialyzerUpgrade erlang26-jinterface-srcUpgrade erlang26-debugger-srcUpgrade erlang-diameterUpgrade erlang26-jinterfaceUpgrade erlang-doc | Dec 5, 2025 | Oct 27, 2025 |
| Ubuntu | — | Upgrade erlang-ssh (Ubuntu Pro)Upgrade erlang-sshUpgrade erlangUpgrade erlang (Ubuntu Pro) | Oct 22, 2025 | Sep 11, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 17, 2025 | Sep 11, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub