Riskcovery

CVE-2025-48038

Unverified File Handles can Cause Excessive Use of System Resources

State
Published
Severity
5.3 Medium
Published
Sep 11, 2025
Updated
Jul 24, 2026
Reserved
May 15, 2025

Read the record on cve.org

Description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
OTPErlang
  • 3.0.1 and laterAffectedfrom 5.3.3Not affectedfrom 5.2.11.3Not affectedfrom 5.1.4.12Not affected
OTPErlang
  • 17.0 and laterAffectedfrom 28.0.3Not affectedfrom 27.3.4.3Not affectedfrom 26.2.5.15Not affected
  • 07b8f441ca711f9812fad9e9115bab3c3aa92f79 and laterAffectedfrom 4e3bf86777ab3db7220c11d8ddabf15970ddd10aNot affectedfrom f09e0201ff701993dc24a08f15e524daf72db42fNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.