CVE-2025-48041: SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48041?
CVE-2025-48041 is considered a potentially critical vulnerability due to its ability to allow excessive resource allocation and flooding in the affected software.
How do I fix CVE-2025-48041?
To fix CVE-2025-48041, upgrade Erlang OTP to a version higher than 28.0.3 or apply the necessary patches as advised by the Erlang development team.
Which versions of Erlang OTP are affected by CVE-2025-48041?
CVE-2025-48041 affects Erlang OTP versions from 17.0 up to and including 28.0.3.
What components of Erlang OTP are impacted by CVE-2025-48041?
CVE-2025-48041 impacts the ssh and ssh_sftp modules within the Erlang OTP library.
Is there a workaround for CVE-2025-48041?
Currently, there is no specific workaround for CVE-2025-48041 aside from upgrading to a non-affected version.