Uncontrolled Memory Allocation in otp - CVE-2025-30211
Published: April 2, 2025
Vulnerability identifier: #VU106381
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-30211
CWE-ID: CWE-789
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to implementation does not verify RFC specified limits on algorithm names provided in KEX init message. A remote attacker can cause a denial of service (DoS) condition on the target system.
Affected software
otp
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
PowerVC
erlang-jinterface
erlang-compiler
erlang-inets
erlang-hipe
erlang-ftp
erlang-examples
erlang-eunit
erlang-et
erlang-erts
erlang-erl_interface
erlang-erl_docgen
erlang-eldap
erlang-edoc
erlang-diameter
erlang-dialyzer
erlang-debugsource
erlang-debuginfo
erlang-debugger
erlang-crypto
erlang-common_test
erlang-asn1
erlang
erlang-megaco
erlang-xmerl
erlang-wx
erlang-tools
erlang-kernel
erlang-tftp
erlang-syntax_tools
erlang-stdlib
erlang-ssl
erlang-ssh
erlang-snmp
erlang-runtime_tools
erlang-reltool
erlang-public_key
erlang-parsetools
erlang-otp_mibs
erlang-os_mon
erlang-odbc
erlang-observer
erlang-mnesia
erlang-sasl
erlang-ssh (Ubuntu package)
erlang (Ubuntu package)
erlang (Debian package)
erlang-src
erlang26-debuginfo
erlang26-reltool
erlang26-observer-src
erlang26-wx-src
erlang26-epmd
erlang26-wx
erlang26
erlang26-et-src
erlang26-et
erlang26-debugsource
erlang26-debugger-src
erlang26-wx-debuginfo
erlang26-dialyzer-src
erlang26-observer
erlang26-dialyzer
erlang26-epmd-debuginfo
erlang26-dialyzer-debuginfo
erlang26-reltool-src
erlang26-doc
erlang26-jinterface-src
erlang26-diameter
erlang26-src
erlang26-diameter-src
erlang26-jinterface
erlang26-debugger
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
PowerVC
erlang-jinterface
erlang-compiler
erlang-inets
erlang-hipe
erlang-ftp
erlang-examples
erlang-eunit
erlang-et
erlang-erts
erlang-erl_interface
erlang-erl_docgen
erlang-eldap
erlang-edoc
erlang-diameter
erlang-dialyzer
erlang-debugsource
erlang-debuginfo
erlang-debugger
erlang-crypto
erlang-common_test
erlang-asn1
erlang
erlang-megaco
erlang-xmerl
erlang-wx
erlang-tools
erlang-kernel
erlang-tftp
erlang-syntax_tools
erlang-stdlib
erlang-ssl
erlang-ssh
erlang-snmp
erlang-runtime_tools
erlang-reltool
erlang-public_key
erlang-parsetools
erlang-otp_mibs
erlang-os_mon
erlang-odbc
erlang-observer
erlang-mnesia
erlang-sasl
erlang-ssh (Ubuntu package)
erlang (Ubuntu package)
erlang (Debian package)
erlang-src
erlang26-debuginfo
erlang26-reltool
erlang26-observer-src
erlang26-wx-src
erlang26-epmd
erlang26-wx
erlang26
erlang26-et-src
erlang26-et
erlang26-debugsource
erlang26-debugger-src
erlang26-wx-debuginfo
erlang26-dialyzer-src
erlang26-observer
erlang26-dialyzer
erlang26-epmd-debuginfo
erlang26-dialyzer-debuginfo
erlang26-reltool-src
erlang26-doc
erlang26-jinterface-src
erlang26-diameter
erlang26-src
erlang26-diameter-src
erlang26-jinterface
erlang26-debugger
How to mitigate CVE-2025-30211
Install updates from vendor's website.
otp - addressed in versions 25.3.2.19, 26.2.5.10, 27.3.1
PowerVC - addressed in versions 2.2.1.2, 2.3.0
erlang-jinterface - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-compiler - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-inets - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-hipe - addressed in versions 21.3.3-6, 23.3.4.9-6
erlang-ftp - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-examples - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-eunit - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-et - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-erts - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-erl_interface - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-erl_docgen - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-eldap - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-edoc - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-diameter - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-dialyzer - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-debugsource - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-debuginfo - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-debugger - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-crypto - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-common_test - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-asn1 - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-megaco - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-xmerl - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-wx - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-tools - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-kernel - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-tftp - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-syntax_tools - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-stdlib - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-ssl - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-ssh - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-snmp - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-runtime_tools - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-reltool - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-public_key - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-parsetools - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-otp_mibs - update to 21.3.3-6
erlang-os_mon - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-odbc - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-observer - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-mnesia - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-sasl - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-ssh (Ubuntu package) - addressed in versions 1:22.2.7+dfsg-1ubuntu0.4, 1:24.2.1+dfsg-1ubuntu0.3, 1:25.3.2.8+dfsg-1ubuntu4.2, 1:25.3.2.12+dfsg-1ubuntu2.2
erlang (Ubuntu package) - addressed in versions 1:22.2.7+dfsg-1ubuntu0.4, 1:24.2.1+dfsg-1ubuntu0.3, 1:25.3.2.8+dfsg-1ubuntu4.2, 1:25.3.2.12+dfsg-1ubuntu2.2
erlang (Debian package) - update to 1:25.2.3+dfsg-1+deb12u1
erlang-src - update to 25.3.2.6-5
erlang26-debuginfo - update to 26.2.1-150300.7.11.1
erlang26-reltool - update to 26.2.1-150300.7.11.1
erlang26-observer-src - update to 26.2.1-150300.7.11.1
erlang26-wx-src - update to 26.2.1-150300.7.11.1
erlang26-epmd - update to 26.2.1-150300.7.11.1
erlang26-wx - update to 26.2.1-150300.7.11.1
erlang26 - update to 26.2.1-150300.7.11.1
erlang26-et-src - update to 26.2.1-150300.7.11.1
erlang26-et - update to 26.2.1-150300.7.11.1
erlang26-debugsource - update to 26.2.1-150300.7.11.1
erlang26-debugger-src - update to 26.2.1-150300.7.11.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.11.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.11.1
erlang26-observer - update to 26.2.1-150300.7.11.1
erlang26-dialyzer - update to 26.2.1-150300.7.11.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.11.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.11.1
erlang26-reltool-src - update to 26.2.1-150300.7.11.1
erlang26-doc - update to 26.2.1-150300.7.11.1
erlang26-jinterface-src - update to 26.2.1-150300.7.11.1
erlang26-diameter - update to 26.2.1-150300.7.11.1
erlang26-src - update to 26.2.1-150300.7.11.1
erlang26-diameter-src - update to 26.2.1-150300.7.11.1
erlang26-jinterface - update to 26.2.1-150300.7.11.1
erlang26-debugger - update to 26.2.1-150300.7.11.1
PowerVC - addressed in versions 2.2.1.2, 2.3.0
erlang-jinterface - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-compiler - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-inets - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-hipe - addressed in versions 21.3.3-6, 23.3.4.9-6
erlang-ftp - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-examples - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-eunit - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-et - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-erts - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-erl_interface - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-erl_docgen - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-eldap - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-edoc - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-diameter - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-dialyzer - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-debugsource - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-debuginfo - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-debugger - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-crypto - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-common_test - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-asn1 - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-megaco - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-xmerl - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-wx - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-tools - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-kernel - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-tftp - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-syntax_tools - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-stdlib - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-ssl - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-ssh - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-snmp - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-runtime_tools - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-reltool - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-public_key - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-parsetools - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-otp_mibs - update to 21.3.3-6
erlang-os_mon - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-odbc - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-observer - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-mnesia - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-sasl - addressed in versions 21.3.3-6, 23.3.4.9-6, 25.3.2.6-5
erlang-ssh (Ubuntu package) - addressed in versions 1:22.2.7+dfsg-1ubuntu0.4, 1:24.2.1+dfsg-1ubuntu0.3, 1:25.3.2.8+dfsg-1ubuntu4.2, 1:25.3.2.12+dfsg-1ubuntu2.2
erlang (Ubuntu package) - addressed in versions 1:22.2.7+dfsg-1ubuntu0.4, 1:24.2.1+dfsg-1ubuntu0.3, 1:25.3.2.8+dfsg-1ubuntu4.2, 1:25.3.2.12+dfsg-1ubuntu2.2
erlang (Debian package) - update to 1:25.2.3+dfsg-1+deb12u1
erlang-src - update to 25.3.2.6-5
erlang26-debuginfo - update to 26.2.1-150300.7.11.1
erlang26-reltool - update to 26.2.1-150300.7.11.1
erlang26-observer-src - update to 26.2.1-150300.7.11.1
erlang26-wx-src - update to 26.2.1-150300.7.11.1
erlang26-epmd - update to 26.2.1-150300.7.11.1
erlang26-wx - update to 26.2.1-150300.7.11.1
erlang26 - update to 26.2.1-150300.7.11.1
erlang26-et-src - update to 26.2.1-150300.7.11.1
erlang26-et - update to 26.2.1-150300.7.11.1
erlang26-debugsource - update to 26.2.1-150300.7.11.1
erlang26-debugger-src - update to 26.2.1-150300.7.11.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.11.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.11.1
erlang26-observer - update to 26.2.1-150300.7.11.1
erlang26-dialyzer - update to 26.2.1-150300.7.11.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.11.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.11.1
erlang26-reltool-src - update to 26.2.1-150300.7.11.1
erlang26-doc - update to 26.2.1-150300.7.11.1
erlang26-jinterface-src - update to 26.2.1-150300.7.11.1
erlang26-diameter - update to 26.2.1-150300.7.11.1
erlang26-src - update to 26.2.1-150300.7.11.1
erlang26-diameter-src - update to 26.2.1-150300.7.11.1
erlang26-jinterface - update to 26.2.1-150300.7.11.1
erlang26-debugger - update to 26.2.1-150300.7.11.1
External References
Related Security Bulletins
- Denial of service in erlang otp
- openEuler 24.03 LTS SP1 update for erlang
- openEuler 24.03 LTS update for erlang
- Ubuntu update for erlang
- Debian update for erlang
- SUSE update for erlang26
- openEuler 22.03 LTS SP4 update for erlang
- openEuler 22.03 LTS SP3 update for erlang
- openEuler 20.03 LTS SP4 update for erlang
- IBM PowerVC update for Erlang/OTP