CVE-2025-48041: Erlang OTP SSH DoS Vulnerability

CVE-2025-48041 Overview

CVE-2025-48041 is a resource exhaustion vulnerability in the Erlang/OTP SSH application, specifically in the ssh_sftpd module implemented in lib/ssh/src/ssh_sftpd.erl. The flaw stems from Allocation of Resources Without Limits or Throttling [CWE-400], allowing an authenticated remote attacker to trigger excessive memory allocation through SFTP protocol flooding.

The issue affects Erlang/OTP releases from OTP 17.0 through OTP 28.0.3, with corresponding ssh application versions from 3.0.1 through 5.3.3. Successful exploitation can disrupt availability of the SSH/SFTP service and impact the hosting Erlang node.

Critical Impact
An authenticated SFTP client can flood the ssh_sftpd server with requests, causing unbounded memory growth that degrades or crashes the Erlang/OTP node hosting the SSH service.

Affected Products

Erlang/OTP versions 17.0 through 28.0.3 (fixed in OTP 28.0.4)
Erlang/OTP 27.x branch up to 27.3.4.3 (fixed in 27.3.4.4)
Erlang/OTP 26.x branch up to 26.2.5.15 (fixed in 26.2.5.16)

Discovery Timeline

2025-09-11 - CVE-2025-48041 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48041

Vulnerability Analysis

The ssh_sftpd module in Erlang/OTP implements the server-side SFTP subsystem layered on top of the SSH transport. The vulnerability arises because the daemon processes incoming SFTP requests without enforcing limits on buffered data, in-flight operations, or per-connection memory consumption.

An authenticated client can submit a sustained stream of SFTP requests that the server queues and processes, causing the Erlang process heap associated with the SFTP session to grow unbounded. Because Erlang processes are scheduled cooperatively on the BEAM virtual machine, runaway memory allocation in one SFTP handler can starve the entire node, leading to denial of service for all hosted services on that VM instance.

The attacker requires valid SSH credentials, which limits exposure to environments where attackers have user-level SFTP access. Servers exposing SFTP to multi-tenant or low-trust user populations face the highest risk.

Root Cause

The root cause is missing throttling and resource accounting inside lib/ssh/src/ssh_sftpd.erl. The handler accepts and dispatches SFTP protocol packets without backpressure on the inbound queue or caps on outstanding read/write buffers. The upstream fixes in commits 5f9af63eec4657a37663828d206517828cb9f288 and d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401 introduce bounds on resource use within the SFTP server logic.

Attack Vector

The attack is network-based and requires low-privilege authentication. After establishing an SSH session and opening the SFTP subsystem, the attacker issues a flood of SFTP operations such as repeated SSH_FXP_OPEN, SSH_FXP_READ, or SSH_FXP_WRITE packets with parameters designed to maximize server-side allocation. The server accumulates state and buffers per request, exhausting memory on the Erlang node.

No exploit code is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in the Erlang Ecosystem Foundation CNA advisory and the GitHub Security Advisory GHSA-79c4-cvv7-4qm3.

Detection Methods for CVE-2025-48041

Indicators of Compromise

Sustained high memory utilization in the BEAM VM process hosting the SSH daemon, particularly correlated with active SFTP sessions.
Sudden spikes in inbound SSH traffic volume from a single authenticated source over short intervals.
Erlang crash dumps (erl_crash.dump) referencing ssh_sftpd processes or out-of-memory termination.
Repeated SFTP subsystem open requests followed by abnormal request rates within a single session.

Detection Strategies

Inventory all Erlang/OTP deployments and compare installed ssh application versions against the fixed versions 5.3.4, 5.2.11.4, and 5.1.4.13.
Monitor BEAM process memory through erlang:memory/0 telemetry and alert on per-process heap growth in ssh_sftpd handlers.
Inspect SSH server logs for unusually high SFTP request rates per authenticated session.
Correlate authentication events with downstream resource consumption to flag credentialed denial of service patterns.

Monitoring Recommendations

Export BEAM VM metrics to a centralized observability platform and set thresholds for memory growth on SSH-hosting nodes.
Track SFTP session duration and packet counts to identify outliers indicative of flooding.
Enable network flow logging on management VLANs hosting Erlang services to retain forensic evidence of abuse patterns.

How to Mitigate CVE-2025-48041

Immediate Actions Required

Upgrade Erlang/OTP to version 28.0.4, 27.3.4.4, or 26.2.5.16, which correspond to ssh application versions 5.3.4, 5.2.11.4, and 5.1.4.13 respectively.
Restrict SFTP access to trusted user populations and remove inactive accounts that retain SFTP privileges.
Place SSH/SFTP endpoints behind network ACLs and require VPN or bastion access for administrative users.
Audit recent SSH authentication logs for accounts with abnormal session counts pending the patch deployment.

Patch Information

The fix is delivered through two upstream commits in the Erlang/OTP repository: commit 5f9af63 and commit d49efa2, merged through pull request #10157. Patched releases are OTP 28.0.4, OTP 27.3.4.4, and OTP 26.2.5.15-derived 26.2.5.16. Refer to the OSV vulnerability record for machine-readable version ranges.

Workarounds

Disable the SFTP subsystem in the SSH daemon configuration if file transfer is not required.
Limit the number of concurrent SSH sessions per user account at the application or PAM layer.
Apply per-connection bandwidth and rate limits at a fronting proxy or firewall to constrain request rates.
Run the Erlang node with reduced memory limits via OS-level cgroups so that exhaustion is contained to a single service.

bash

# Verify installed Erlang/OTP and ssh application versions
erl -eval 'io:format("OTP: ~s~nssh: ~s~n", [erlang:system_info(otp_release), element(3, lists:keyfind(ssh, 1, application:loaded_applications()))]), halt().' -noshell