CVE-2025-26618 - CVE House
Back to Database
Status published High CVE-2025-26618

SSH SFTP packet size not verified properly in Erlang OTP

Vulnerability Description

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet size is not verified properly for SFTP packets. As a result when multiple SSH packets (conforming to max SSH packet size) are received by ssh, they might be combined into an SFTP packet which will exceed the max allowed packet size and potentially cause large amount of memory to be allocated. Note that situation described above can only happen for successfully authenticated users after completing the SSH handshake. This issue has been patched in OTP versions 27.2.4, 26.2.5.9, and 25.3.2.18. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-26618

Credits & Attribution

No credits recorded in the NVD database.

References

More from erlang

View All →
CVE-2025-46712
Erlang/OTP SSH Has Strict KEX Violations
Low 3.7
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
Critical 10
CVE-2025-30211
KEX init error results with excessive memory usage
High 7.5
CVE-2024-53846
ssl fails to validate incorrect extened key usage
Medium 5.5
CVE-2022-37026
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before...
Unknown 0

Affected Vendor

Affected Software

otp
Vulnerable Versions:
>= OTP-27.0.0, < OTP-27.2.4, >= OTP-26.0.0.0, < OTP-26.2.5.9, < OTP-25.3.2.18

Timeline

Official Publish: February 20th, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-789

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.