Riskcovery

CVE-2025-48039

Unverified Paths can Cause Excessive Use of System Resources

State
Published
Severity
5.3 Medium
Published
Sep 11, 2025
Updated
Jul 24, 2026
Reserved
May 15, 2025

Read the record on cve.org

Description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
OTPErlang
  • 3.0.1 and laterAffectedfrom 5.3.3Not affectedfrom 5.2.11.3Not affectedfrom 5.1.4.12Not affected
OTPErlang
  • 17.0 and laterAffectedfrom 28.0.3Not affectedfrom 27.3.4.3Not affectedfrom 26.2.5.15Not affected
  • 07b8f441ca711f9812fad9e9115bab3c3aa92f79 and laterAffectedfrom c242e6458967e9514bea351814151695807a54acNot affectedfrom 043ee3c943e2977c1acdd740ad13992fd60b6bf0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.