Junglewise Threat Intelligence

CVE-2025-48041: Erlang OTP resource exhaustion in ssh_sftpd

CVE-2025-48041 · Severity: info · CVSS 7.1 · Published 2025-09-11

Vendors: Erlang/OTP.

Executive brief

A vulnerability in the Erlang/OTP SFTP server component could allow an authenticated user to crash the service or exhaust system resources. By repeatedly opening directories without closing them, an attacker can consume all available file handles, leading to a denial-of-service condition. This affects systems where the SFTP subsystem is enabled, which is the default configuration for the Erlang SSH daemon.

Technical details

An uncontrolled resource consumption vulnerability exists in the Erlang/OTP ssh_sftpd module (lib/ssh/src/ssh_sftpd.erl). The SFTP server implementation failed to limit or throttle the number of file handles a single connection could open using the SSH_FXP_OPENDIR command. A remote authenticated attacker can exploit this by flooding the server with requests, leading to file handle exhaustion and a denial-of-service (DoS) state. The fix introduces a 'max_handles' configuration option, which defaults to 1000, to enforce limits on open handles per connection.

Affected products

  • Erlang/OTP ssh 3.0.1 - 5.3.3, 5.2.11.3, 5.1.4.12
  • Erlang/OTP OTP 17.0 - 28.0.3, 27.3.4.3, 26.2.5.15

Timeline

  • 2025-08-20: patched: Initial patch authored
  • 2025-09-11: disclosed: CVE published

References