Resource exhaustion in otp - CVE-2025-48039

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU117391

Resource exhaustion in otp - CVE-2025-48039

Published: October 20, 2025


Vulnerability identifier: #VU117391
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-48039
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote SFTP user can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

otp
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Ubuntu
Server Applications Module
openSUSE Leap
openEuler
erlang (Ubuntu package)
erlang-debuginfo
erlang-tools
erlang-tftp
erlang
erlang-asn1
erlang-common_test
erlang-compiler
erlang-crypto
erlang-debugger
erlang-debugsource
erlang-dialyzer
erlang-diameter
erlang-edoc
erlang-wx
erlang-xmerl
erlang-erl_interface
erlang-eldap
erlang-mnesia
erlang-syntax_tools
erlang-stdlib
erlang-ssl
erlang-ssh
erlang-snmp
erlang-sasl
erlang-runtime_tools
erlang-reltool
erlang-public_key
erlang-parsetools
erlang-os_mon
erlang-odbc
erlang-observer
erlang-megaco
erlang-kernel
erlang-jinterface
erlang-inets
erlang-hipe
erlang-ftp
erlang-examples
erlang-eunit
erlang-et
erlang-erts
erlang-erl_docgen
erlang-reltool-src
erlang-diameter-src
erlang-et-src
erlang-doc
erlang-debugger-src
erlang-jinterface-src
erlang-dialyzer-src
erlang-wx-src
erlang-wx-debuginfo
erlang-epmd-debuginfo
erlang-epmd
erlang-dialyzer-debuginfo
erlang-src
erlang-observer-src
erlang26-epmd-debuginfo
erlang26-doc
erlang26-wx
erlang26-dialyzer
erlang26-reltool
erlang26-observer-src
erlang26-jinterface-src
erlang26-debugger-src
erlang26-epmd
erlang26-debugger
erlang26-debugsource
erlang26-dialyzer-src
erlang26-observer
erlang26-dialyzer-debuginfo
erlang26-debuginfo
erlang26-reltool-src
erlang26-wx-debuginfo
erlang26-et
erlang26-wx-src
erlang26-diameter-src
erlang26-et-src
erlang26
erlang26-diameter
erlang26-src
erlang26-jinterface

How to mitigate CVE-2025-48039

Install updates from vendor's website.

otp - addressed in versions 26.2.5.15, 27.3.4.3, 28.0.3
erlang (Ubuntu package) - addressed in versions 1:16.b.3-dfsg-1ubuntu2.2+esm1, 1:18.3-dfsg-1ubuntu3.1+esm2, 1:20.2.2+dfsg-1ubuntu2+esm2, 1:22.2.7+dfsg-1ubuntu0.5+esm1, 1:24.2.1+dfsg-1ubuntu0.6, 1:25.3.2.8+dfsg-1ubuntu4.5, 1:27.3+dfsg-1ubuntu1.3, 1:27.3.4.1+dfsg-1ubuntu0.1
erlang-debuginfo - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-tools - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-tftp - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-asn1 - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-common_test - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-compiler - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-crypto - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-debugger - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-debugsource - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-dialyzer - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-diameter - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-edoc - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-wx - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-xmerl - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-erl_interface - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-eldap - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-mnesia - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-syntax_tools - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-stdlib - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-ssl - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-ssh - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-snmp - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-sasl - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-runtime_tools - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-reltool - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-public_key - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-parsetools - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-os_mon - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-odbc - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-observer - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-megaco - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-kernel - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-jinterface - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-inets - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-hipe - update to 23.3.4.9-8
erlang-ftp - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-examples - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-eunit - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-et - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-erts - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang-erl_docgen - addressed in versions 23.3.4.9-8, 25.3.2.6-11
erlang - update to 23.3.4.19-150300.3.29.1
erlang-observer - update to 23.3.4.19-150300.3.29.1
erlang-reltool-src - update to 23.3.4.19-150300.3.29.1
erlang-diameter-src - update to 23.3.4.19-150300.3.29.1
erlang-debugsource - update to 23.3.4.19-150300.3.29.1
erlang-et-src - update to 23.3.4.19-150300.3.29.1
erlang-doc - update to 23.3.4.19-150300.3.29.1
erlang-debuginfo - update to 23.3.4.19-150300.3.29.1
erlang-debugger-src - update to 23.3.4.19-150300.3.29.1
erlang-jinterface-src - update to 23.3.4.19-150300.3.29.1
erlang-dialyzer - update to 23.3.4.19-150300.3.29.1
erlang-dialyzer-src - update to 23.3.4.19-150300.3.29.1
erlang-wx-src - update to 23.3.4.19-150300.3.29.1
erlang-reltool - update to 23.3.4.19-150300.3.29.1
erlang-wx-debuginfo - update to 23.3.4.19-150300.3.29.1
erlang-debugger - update to 23.3.4.19-150300.3.29.1
erlang-epmd-debuginfo - update to 23.3.4.19-150300.3.29.1
erlang-wx - update to 23.3.4.19-150300.3.29.1
erlang-epmd - update to 23.3.4.19-150300.3.29.1
erlang-diameter - update to 23.3.4.19-150300.3.29.1
erlang-jinterface - update to 23.3.4.19-150300.3.29.1
erlang-dialyzer-debuginfo - update to 23.3.4.19-150300.3.29.1
erlang-et - update to 23.3.4.19-150300.3.29.1
erlang-src - update to 23.3.4.19-150300.3.29.1
erlang-observer-src - update to 23.3.4.19-150300.3.29.1
erlang-src - update to 25.3.2.6-11
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.22.1
erlang26-doc - update to 26.2.1-150300.7.22.1
erlang26-wx - update to 26.2.1-150300.7.22.1
erlang26-dialyzer - update to 26.2.1-150300.7.22.1
erlang26-reltool - update to 26.2.1-150300.7.22.1
erlang26-observer-src - update to 26.2.1-150300.7.22.1
erlang26-jinterface-src - update to 26.2.1-150300.7.22.1
erlang26-debugger-src - update to 26.2.1-150300.7.22.1
erlang26-epmd - update to 26.2.1-150300.7.22.1
erlang26-debugger - update to 26.2.1-150300.7.22.1
erlang26-debugsource - update to 26.2.1-150300.7.22.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.22.1
erlang26-observer - update to 26.2.1-150300.7.22.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.22.1
erlang26-debuginfo - update to 26.2.1-150300.7.22.1
erlang26-reltool-src - update to 26.2.1-150300.7.22.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.22.1
erlang26-et - update to 26.2.1-150300.7.22.1
erlang26-wx-src - update to 26.2.1-150300.7.22.1
erlang26-diameter-src - update to 26.2.1-150300.7.22.1
erlang26-et-src - update to 26.2.1-150300.7.22.1
erlang26 - update to 26.2.1-150300.7.22.1
erlang26-diameter - update to 26.2.1-150300.7.22.1
erlang26-src - update to 26.2.1-150300.7.22.1
erlang26-jinterface - update to 26.2.1-150300.7.22.1

External References

Related Security Bulletins