CVE-2025-26618 SSH SFTP packet size not verified properly in Erlang OTP
Authenticated users can cause excessive memory allocation in Erlang OTP SFTP server by sending crafted SSH packets, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-26618?
CVE-2025-26618 is a high-severity denial of service vulnerability in erlang otp, published on 20 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet size is not verified properly for SFTP packets. As a result when multiple SSH packets (conforming to max SSH packet size) are received by ssh, they might be combined into an SFTP packet which will exceed the max allowed packet size and potentially cause large amount of memory to be allocated. Note that situation described above can only happen for successfully authenticated users after completing the SSH handshake. This issue has been patched in OTP versions 27.2.4, 26.2.5.9, and 25.3.2.18. There are no known workarounds for this vulnerability.
Weakness: CWE-789
Which versions are affected by CVE-2025-26618?
Linux distribution packages (5)
erlang SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 23.3.4.19-150300.3.17.1 |
erlang26 SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 26.2.1-150300.7.8.1 |
erlang openSUSE:Leap 15.6 | All versions | 23.3.4.19-150300.3.17.1 |
erlang26 openSUSE:Leap 15.6 | All versions | 26.2.1-150300.7.8.1 |
erlang openSUSE:Tumbleweed | All versions | 27.2.4-2.1 |
How do I fix CVE-2025-26618?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-26618 being exploited?
There is no known exploitation of CVE-2025-26618 in the wild and no public exploit code.
Sources
Also known as AZL-57083, AZL-57095, DEBIAN-CVE-2025-26618, GHSA-78cv-45vx-q6fr, MGASA-2025-0088, OESA-2025-1220 and 5 more.