Riskcovery

CVE-2025-48041

SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

State
Published
Severity
7.1 High
Published
Sep 11, 2025
Updated
Jul 24, 2026
Reserved
May 15, 2025

Read the record on cve.org

Description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.

Scores

CVSSScoreVectorSource
4.07.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
OTPErlang
  • 3.0.1 and laterAffectedfrom 5.3.3Not affectedfrom 5.2.11.3Not affectedfrom 5.1.4.12Not affected
OTPErlang
  • 17.0 and laterAffectedfrom 28.0.3Not affectedfrom 27.3.4.3Not affectedfrom 26.2.5.15Not affected
  • 07b8f441ca711f9812fad9e9115bab3c3aa92f79 and laterAffectedfrom 5f9af63eec4657a37663828d206517828cb9f288Not affectedfrom d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.