# CVE-2025-48038: Erlang OTP resource exhaustion in SFTP server handle processing

Source: https://junglewise.ai/threats/cve-2025-48038-erlang-otp-resource-exhaustion-in-sftp-server-handle-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-11. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-48038 · Severity: info · CVSS 5.3 · Published 2025-09-11

A vulnerability in the Erlang/OTP SSH library could allow an authenticated user to cause excessive resource consumption on the server. By sending specially crafted SFTP file handles, an attacker can exhaust CPU and memory, potentially leading to a denial of service or system instability. This affects systems where the SFTP subsystem is enabled, which is the default configuration.

## Quick answers

**Is CVE-2025-48038 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-48038 being exploited in the wild.

**How severe is CVE-2025-48038?** Informational severity, with a CVSS score of 5.3, published 11 September 2025.

**Which products and versions are affected?** Erlang/OTP ssh 3.0.1 to 5.3.2, 5.2.11.2, 5.1.4.11; Erlang/OTP OTP 17.0 to 28.0.2, 27.3.4.2, 26.2.5.14.

**Is there a fix for CVE-2025-48038?** A patch was published on 2025-09-10: Fixes merged into master branch and security advisory published Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-48038 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-48038?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SFTP server implementation in Erlang/OTP (ssh_sftpd.erl) fails to enforce size limits on file handle strings provided by clients. According to SFTP specifications (draft-ietf-secsh-filexfer-02), file handles should not exceed 256 bytes; however, the vulnerable versions do not validate this length during operations such as CLOSE, FSTAT, READ, or WRITE. An authenticated attacker can provide excessively large handles to trigger uncontrolled resource allocation (CWE-770) and CPU consumption. The vulnerability is reachable over the network if the SFTP subsystem is enabled (default). Patches have been released in OTP versions 28.0.3, 27.3.4.3, and 26.2.5.15.

## Affected products

- Erlang/OTP ssh 3.0.1 to 5.3.2, 5.2.11.2, 5.1.4.11
- Erlang/OTP OTP 17.0 to 28.0.2, 27.3.4.2, 26.2.5.14

## Timeline

- 2025-08-27: other: Initial patch commits authored
- 2025-09-10: patched: Fixes merged into master branch and security advisory published
- 2025-09-11: disclosed: CVE published to NVD

## References

- [https://cna.erlef.org/cves/CVE-2025-48038.html](https://cna.erlef.org/cves/CVE-2025-48038.html)
- [https://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a](https://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a)
- [https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f](https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f)
- [https://github.com/erlang/otp/pull/10156](https://github.com/erlang/otp/pull/10156)
- [https://github.com/erlang/otp/security/advisories/GHSA-pvj7-9652-7h9r](https://github.com/erlang/otp/security/advisories/GHSA-pvj7-9652-7h9r)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)