# CVE-2025-48041: Erlang OTP resource exhaustion in ssh_sftpd

Source: https://junglewise.ai/threats/cve-2025-48041-erlang-otp-resource-exhaustion-in-ssh-sftpd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-11. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-48041 · Severity: info · CVSS 7.1 · Published 2025-09-11

A vulnerability in the Erlang/OTP SFTP server component could allow an authenticated user to crash the service or exhaust system resources. By repeatedly opening directories without closing them, an attacker can consume all available file handles, leading to a denial-of-service condition. This affects systems where the SFTP subsystem is enabled, which is the default configuration for the Erlang SSH daemon.

## Quick answers

**Is CVE-2025-48041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-48041 being exploited in the wild.

**How severe is CVE-2025-48041?** Informational severity, with a CVSS score of 7.1, published 11 September 2025.

**Which products and versions are affected?** Erlang/OTP ssh 3.0.1 - 5.3.3, 5.2.11.3, 5.1.4.12; Erlang/OTP OTP 17.0 - 28.0.3, 27.3.4.3, 26.2.5.15.

**Is there a fix for CVE-2025-48041?** A patch was published on 2025-08-20: Initial patch authored Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-48041 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-48041?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled resource consumption vulnerability exists in the Erlang/OTP ssh_sftpd module (lib/ssh/src/ssh_sftpd.erl). The SFTP server implementation failed to limit or throttle the number of file handles a single connection could open using the SSH_FXP_OPENDIR command. A remote authenticated attacker can exploit this by flooding the server with requests, leading to file handle exhaustion and a denial-of-service (DoS) state. The fix introduces a 'max_handles' configuration option, which defaults to 1000, to enforce limits on open handles per connection.

## Affected products

- Erlang/OTP ssh 3.0.1 - 5.3.3, 5.2.11.3, 5.1.4.12
- Erlang/OTP OTP 17.0 - 28.0.3, 27.3.4.3, 26.2.5.15

## Timeline

- 2025-08-20: patched: Initial patch authored
- 2025-09-11: disclosed: CVE published

## References

- [https://cna.erlef.org/cves/CVE-2025-48041.html](https://cna.erlef.org/cves/CVE-2025-48041.html)
- [https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288](https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288)
- [https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401](https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401)
- [https://github.com/erlang/otp/pull/10157](https://github.com/erlang/otp/pull/10157)
- [https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3](https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)