CVE-2025-48038

Unverified File Handles can Cause Excessive Use of System Resources

MEDIUM

5.3

CVSS Score

Published: September 11, 2025 at 08:13 AM UTC

Updated: July 24, 2026 at 03:33 PM UTC

1 product affected across 1 vendorErlang /otp

Using OTP by Erlang?

Get instant alerts when new vulnerabilities affect OTP - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Erlang /otp · Erlang

95%

v ≥ 17.0v ≥ 3.0.1v < 26.2.5.1527.0 ≤ v < 27.3.4.328.0 ≤ v < 28.0.317.0 3.0.17b8f441ca711f9812fad9e9115bab3c3aa92f79

Affected range stops below 26.2.5.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 27.3.4.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 28.0.3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references