CVE-2025-30211 - CVE House
Back to Database
Status published High CVE-2025-30211

KEX init error results with excessive memory usage

Vulnerability Description

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-30211

Credits & Attribution

No credits recorded in the NVD database.

References

More from erlang

View All →
CVE-2025-46712
Erlang/OTP SSH Has Strict KEX Violations
Low 3.7
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
Critical 10
CVE-2025-26618
SSH SFTP packet size not verified properly in Erlang OTP
High 7
CVE-2024-53846
ssl fails to validate incorrect extened key usage
Medium 5.5
CVE-2022-37026
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before...
Unknown 0

Affected Vendor

Affected Software

otp
Vulnerable Versions:
< OTP-27.3.1, < OTP-26.2.5.10, < OTP-25.3.2.19

Timeline

Official Publish: March 28th, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-789

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.