CVE-2025-48039: Erlang OTP SSH Resource Exhaustion DoS Flaw

CVE-2025-48039 Overview

CVE-2025-48039 is a resource exhaustion vulnerability in the Erlang/OTP ssh_sftpd module. The flaw stems from allocation of resources without limits or throttling ([CWE-400]) in lib/ssh/src/ssh_sftpd.erl. An authenticated SFTP client can send oversized path data to the server, causing excessive memory allocation and resource leaks.

The vulnerability affects Erlang/OTP versions from 17.0 before 28.0.3, plus 27.3.4.3 and 26.2.5.15. Corresponding ssh application versions range from 3.0.1 before 5.3.3, 5.2.11.3, and 5.1.4.12.

Critical Impact
Authenticated SFTP clients can trigger excessive resource allocation on the SSH server, leading to availability degradation of Erlang/OTP-based services.

Affected Products

Erlang/OTP versions 17.0 through 28.0.2 (fixed in 28.0.3)
Erlang/OTP 27.x prior to 27.3.4.3
Erlang/OTP 26.x prior to 26.2.5.15

Discovery Timeline

2025-09-11 - CVE-2025-48039 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2025-48039

Vulnerability Analysis

The Erlang/OTP ssh_sftpd server implementation processes SFTP protocol requests from authenticated clients. The server accepts path data from clients without enforcing an upper bound on path length. An attacker with valid SSH credentials can transmit arbitrarily large path strings, forcing the server to allocate proportional memory.

Repeated requests amplify the effect and can degrade the availability of the SSH subsystem or the entire Erlang node. The impact is limited to availability, with no confidentiality or integrity compromise. Exploitation requires low-privileged authentication and network access to the SFTP service.

Root Cause

The ssh_sftpd module did not enforce a maximum path size for data received from SFTP clients. The record state in lib/ssh/src/ssh_sftpd.erl tracked max_files for READDIR throttling but had no equivalent max_path field for validating inbound path lengths. Client-supplied paths were passed to file operations without size checks.

Attack Vector

An authenticated remote attacker connects to the SFTP subsystem over SSH and issues SFTP requests containing oversized path fields. Because parsing and copying scale with input size, each request consumes memory and CPU. The attacker sustains or repeats the requests to exhaust server resources.

text

// Patch: introduce max_path field in ssh_sftpd state record
// Source: https://github.com/erlang/otp/commit/c242e6458967e9514bea351814151695807a54ac
  file_handler,                 % atom() - callback module
  file_state,                   % state for the file callback module
  max_files,                    % integer >= 0 max no files sent during READDIR
+ max_path,                     % integer > 0 - max length of path
  options,                      % from the subsystem declaration
  handles                       % list of open handles

The fix adds a max_path option (default 4096) that bounds path lengths accepted from clients. See the GitHub Security Advisory GHSA-rr5p-6856-j7h8 and OTP Pull Request #10155 for full details.

Detection Methods for CVE-2025-48039

Indicators of Compromise

Sustained high memory or CPU utilization on Erlang/OTP nodes running the ssh_sftpd subsystem.
SFTP session logs showing repeated requests from a single authenticated user with unusually large path fields.
Erlang crash dumps or OOM events tied to the SSH application process tree.

Detection Strategies

Monitor Erlang VM metrics (memory/0, process count, and message queue lengths) for the SSH supervisor tree and alert on abnormal growth.
Correlate SFTP audit logs with per-user request counts and payload sizes to identify path-length anomalies.
Baseline normal SFTP workload characteristics and flag deviations in request frequency or size distribution.

Monitoring Recommendations

Enable verbose SSH logging on Erlang/OTP nodes and forward events to a centralized log platform.
Track authenticated session activity per account and alert on repeated abnormal SFTP operations.
Instrument the Erlang node with telemetry hooks to capture memory allocation spikes tied to ssh_sftpd processes.

How to Mitigate CVE-2025-48039

Immediate Actions Required

Upgrade Erlang/OTP to 28.0.3, 27.3.4.3, or 26.2.5.15 depending on your release branch.
Restrict SFTP subsystem access to trusted networks and users while planning the upgrade.
Review authorized SFTP accounts and rotate credentials for any accounts no longer required.

Patch Information

The fix is delivered in Erlang/OTP 28.0.3, 27.3.4.3, and 26.2.5.15. The patch introduces a max_path option in ssh_sftpd that enforces a default maximum path length of 4096 bytes for client-supplied data. See the OTP commit 043ee3c and the CNA advisory for CVE-2025-48039 for authoritative patch information.

Workarounds

Disable the ssh_sftpd subsystem on Erlang/OTP nodes where SFTP service is not required.
Place SFTP endpoints behind a network-layer proxy or firewall that enforces per-connection rate limits.
Apply operating system resource limits (ulimit, cgroups) to constrain memory available to the Erlang VM.

bash

# Configuration example: enforce path length limit after upgrading
# In your SSH daemon subsystem configuration, set max_path explicitly
ssh:daemon(2222, [
  {subsystems, [
    ssh_sftpd:subsystem_spec([
      {max_path, 4096},
      {max_files, 100}
    ])
  ]}
]).