CVE-2025-26618: Erlang/OTP SSH SFTP DoS Vulnerability

CVE-2025-26618 Overview

CVE-2025-26618 is a memory exhaustion vulnerability affecting the Erlang OTP (Open Telecom Platform) SSH library's SFTP implementation. The vulnerability stems from improper packet size verification for SFTP packets, which can allow authenticated attackers to cause excessive memory allocation on affected systems. When multiple SSH packets conforming to the maximum SSH packet size are received, they may be combined into an SFTP packet that exceeds the maximum allowed packet size, potentially triggering large memory allocations and leading to denial of service conditions.

Critical Impact

Authenticated attackers can exploit this vulnerability to cause memory exhaustion on systems running vulnerable Erlang OTP versions, potentially leading to service disruption of applications relying on the SSH/SFTP functionality.

Affected Products

• Erlang OTP versions prior to 27.2.4
• Erlang OTP versions prior to 26.2.5.9
• Erlang OTP versions prior to 25.3.2.18

Discovery Timeline

• February 20, 2025 - CVE CVE-2025-26618 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-26618

Vulnerability Analysis

This vulnerability is classified under CWE-789 (Memory Allocation with Excessive Size Value), which describes scenarios where software allocates memory based on an untrusted size value without properly validating that the size falls within expected limits. In the context of Erlang OTP's SSH/SFTP implementation, the SFTP subsystem fails to properly validate the aggregate size of SFTP packets when multiple SSH packets are combined.

The exploitation requires successful authentication, meaning an attacker must first complete the SSH handshake before being able to trigger the vulnerability. This constraint limits the attack surface to authenticated users, though it still poses a significant risk in multi-tenant environments or systems with compromised credentials.

Root Cause

The root cause lies in the ssh_sftpd.erl module within the Erlang OTP SSH library. The code did not properly enforce packet size limits when processing SFTP packets that were assembled from multiple underlying SSH packets. While individual SSH packets respected maximum size constraints, the combined SFTP packet could exceed safe memory allocation limits, leading to potential resource exhaustion.

Attack Vector

The attack is network-based and requires low privileges (authenticated session). An attacker with valid SSH credentials can send specially crafted sequences of SSH packets that, when combined by the SFTP subsystem, result in an oversized SFTP packet. This triggers memory allocation operations that can exhaust available system memory, affecting not only the SSH service but potentially the entire host system's stability.

The attack requires network access to the SSH service and successful authentication. The vulnerability specifically impacts the SFTP subsystem, so systems that expose SSH with SFTP functionality are at risk.

-behaviour(ssh_server_channel).
 
 -include_lib("kernel/include/file.hrl").
-
+-include_lib("kernel/include/logger.hrl").
 -include("ssh.hrl").
 -include("ssh_xfer.hrl").
 -include("ssh_connect.hrl"). %% For ?DEFAULT_PACKET_SIZE and ?DEFAULT_WINDOW_SIZE

Source: GitHub Commit Update

The patch adds logger functionality and implements proper packet size validation to reject SFTP packets that exceed the defined limits.

Detection Methods for CVE-2025-26618

Indicators of Compromise

• Unusual memory consumption spikes on systems running Erlang OTP SSH services
• SSH/SFTP service crashes or restarts due to out-of-memory conditions
• Log entries indicating oversized packet processing or memory allocation failures in SSH-related processes
• Abnormal patterns of authenticated SSH sessions with unusual traffic characteristics

Detection Strategies

• Monitor memory usage metrics for Erlang BEAM processes hosting SSH services
• Implement alerting on rapid memory growth following SSH authentication events
• Review SSH server logs for patterns of large packet sequences from single authenticated sessions
• Deploy network monitoring to identify anomalous SSH traffic patterns that may indicate exploitation attempts

Monitoring Recommendations

• Configure resource limits for Erlang processes to contain potential memory exhaustion attacks
• Enable verbose logging for SSH/SFTP subsystems to capture packet processing anomalies
• Implement real-time memory monitoring dashboards for critical systems running Erlang OTP
• Set up automated alerts for SSH service restarts or memory-related failures

How to Mitigate CVE-2025-26618

Immediate Actions Required

• Upgrade Erlang OTP to patched versions: 27.2.4, 26.2.5.9, or 25.3.2.18 depending on your branch
• Review and restrict SSH access to only necessary users and networks
• Implement resource limits (memory cgroups) for Erlang processes as a temporary defensive measure
• Monitor systems for signs of exploitation while planning upgrade activities

Patch Information

The Erlang OTP team has released security patches in versions 27.2.4, 26.2.5.9, and 25.3.2.18. The fix implements proper packet size validation in the SFTP subsystem to reject packets exceeding the defined limits. The patch commit (0ed2573cbd55c92e9125c9dc70fa1ca7fed82872) adds logger functionality and enforces size constraints on SFTP packet processing.

For detailed patch information, refer to the GitHub Security Advisory and the Erlang OTP Release Notes. Debian users should consult the Debian LTS Announcement for distribution-specific updates.

Workarounds

• No official workarounds are available for this vulnerability; patching is the recommended remediation
• Restrict SSH/SFTP access to trusted networks and users through firewall rules as a compensating control
• Consider temporarily disabling SFTP functionality if not required until patches can be applied
• Implement memory resource limits at the container or cgroup level to minimize impact of potential exploitation

# Verify current Erlang OTP version
erl -eval 'erlang:display(erlang:system_info(otp_release)), halt().' -noshell

# Check for patched versions available in package manager (example for Debian/Ubuntu)
apt-cache policy erlang

# Apply resource limits via systemd for Erlang services
# Add to service unit file [Service] section:
# MemoryMax=2G
# MemoryHigh=1.5G