CVE-2025-48040 - CVE House
Back to Database
Status published Medium CVE-2025-48040

Malicious Key Exchange Messages may Lead to Excessive Resource Consumption

Vulnerability Description

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48040

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Jakub Witczak
  • Ingela Anderton Andin

References

More from Erlang

View All →
CVE-2025-4748
Absolute path traversal in zip:unzip/1,2
Medium 4.8
CVE-2025-48041
SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
High 7.1
CVE-2025-48039
Unverified Paths can Cause Excessive Use of System Resources
Medium 5.3
CVE-2025-48038
Unverified File Handles can Cause Excessive Use of System Resources
Medium 5.3

Affected Vendor

Affected Software

OTP
Vulnerable Versions:
3.0.1, 17.0, 07b8f441ca711f9812fad9e9115bab3c3aa92f79

Timeline

Official Publish: September 11th, 2025
Last Modified: June 5th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-400 CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery