Uncontrolled recursion in otp - CVE-2025-48040

Vulnerability identifier: #VU117392

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-48040

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

otp
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Ubuntu
Server Applications Module
openSUSE Leap
openEuler
erlang (Ubuntu package)
erlang-diameter
erlang
erlang-wx-src
erlang-reltool
erlang-wx-debuginfo
erlang-debugger
erlang-epmd-debuginfo
erlang-wx
erlang-epmd
erlang-observer-src
erlang-jinterface
erlang-dialyzer-debuginfo
erlang-et
erlang-src
erlang-reltool-src
erlang-observer
erlang-dialyzer-src
erlang-dialyzer
erlang-jinterface-src
erlang-debugger-src
erlang-doc
erlang-et-src
erlang-debugsource
erlang-diameter-src
erlang-debuginfo
erlang-runtime_tools
erlang-public_key
erlang-parsetools
erlang-os_mon
erlang-odbc
erlang-mnesia
erlang-megaco
erlang-kernel
erlang-sasl
erlang-snmp
erlang-ssh
erlang-ssl
erlang-stdlib
erlang-syntax_tools
erlang-tftp
erlang-tools
erlang-xmerl
erlang-asn1
erlang-common_test
erlang-compiler
erlang-crypto
erlang-inets
erlang-edoc
erlang-eldap
erlang-erl_docgen
erlang-erl_interface
erlang-erts
erlang-eunit
erlang-examples
erlang-ftp
erlang26-observer
erlang26-dialyzer-src
erlang26-debugsource
erlang26-debugger
erlang26-epmd
erlang26-debugger-src
erlang26-jinterface-src
erlang26-observer-src
erlang26-reltool
erlang26-diameter
erlang26-dialyzer
erlang26-wx
erlang26-epmd-debuginfo
erlang26-dialyzer-debuginfo
erlang26-debuginfo
erlang26-reltool-src
erlang26-wx-debuginfo
erlang26-et
erlang26-wx-src
erlang26-diameter-src
erlang26-et-src
erlang26
erlang26-jinterface
erlang26-doc
erlang26-src

Install updates from vendor's website.

otp - addressed in versions 26.2.5.15, 27.3.4.3, 28.0.3
erlang (Ubuntu package) - addressed in versions 1:16.b.3-dfsg-1ubuntu2.2+esm1, 1:18.3-dfsg-1ubuntu3.1+esm2, 1:20.2.2+dfsg-1ubuntu2+esm2, 1:22.2.7+dfsg-1ubuntu0.5+esm1, 1:24.2.1+dfsg-1ubuntu0.6, 1:25.3.2.8+dfsg-1ubuntu4.5, 1:27.3+dfsg-1ubuntu1.3, 1:27.3.4.1+dfsg-1ubuntu0.1
erlang-diameter - update to 23.3.4.19-150300.3.29.1
erlang - update to 23.3.4.19-150300.3.29.1
erlang-wx-src - update to 23.3.4.19-150300.3.29.1
erlang-reltool - update to 23.3.4.19-150300.3.29.1
erlang-wx-debuginfo - update to 23.3.4.19-150300.3.29.1
erlang-debugger - update to 23.3.4.19-150300.3.29.1
erlang-epmd-debuginfo - update to 23.3.4.19-150300.3.29.1
erlang-wx - update to 23.3.4.19-150300.3.29.1
erlang-epmd - update to 23.3.4.19-150300.3.29.1
erlang-observer-src - update to 23.3.4.19-150300.3.29.1
erlang-jinterface - update to 23.3.4.19-150300.3.29.1
erlang-dialyzer-debuginfo - update to 23.3.4.19-150300.3.29.1
erlang-et - update to 23.3.4.19-150300.3.29.1
erlang-src - update to 23.3.4.19-150300.3.29.1
erlang-reltool-src - update to 23.3.4.19-150300.3.29.1
erlang-observer - update to 23.3.4.19-150300.3.29.1
erlang-dialyzer-src - update to 23.3.4.19-150300.3.29.1
erlang-dialyzer - update to 23.3.4.19-150300.3.29.1
erlang-jinterface-src - update to 23.3.4.19-150300.3.29.1
erlang-debugger-src - update to 23.3.4.19-150300.3.29.1
erlang-doc - update to 23.3.4.19-150300.3.29.1
erlang-et-src - update to 23.3.4.19-150300.3.29.1
erlang-debugsource - update to 23.3.4.19-150300.3.29.1
erlang-diameter-src - update to 23.3.4.19-150300.3.29.1
erlang-debuginfo - update to 23.3.4.19-150300.3.29.1
erlang-runtime_tools - update to 25.3.2.6-11
erlang-reltool - update to 25.3.2.6-11
erlang-public_key - update to 25.3.2.6-11
erlang-parsetools - update to 25.3.2.6-11
erlang-os_mon - update to 25.3.2.6-11
erlang-odbc - update to 25.3.2.6-11
erlang-observer - update to 25.3.2.6-11
erlang-mnesia - update to 25.3.2.6-11
erlang-megaco - update to 25.3.2.6-11
erlang-kernel - update to 25.3.2.6-11
erlang-jinterface - update to 25.3.2.6-11
erlang-sasl - update to 25.3.2.6-11
erlang-snmp - update to 25.3.2.6-11
erlang-src - update to 25.3.2.6-11
erlang-ssh - update to 25.3.2.6-11
erlang-ssl - update to 25.3.2.6-11
erlang-stdlib - update to 25.3.2.6-11
erlang-syntax_tools - update to 25.3.2.6-11
erlang-tftp - update to 25.3.2.6-11
erlang-tools - update to 25.3.2.6-11
erlang-xmerl - update to 25.3.2.6-11
erlang-wx - update to 25.3.2.6-11
erlang-diameter - update to 25.3.2.6-11
erlang - update to 25.3.2.6-11
erlang-asn1 - update to 25.3.2.6-11
erlang-common_test - update to 25.3.2.6-11
erlang-compiler - update to 25.3.2.6-11
erlang-crypto - update to 25.3.2.6-11
erlang-debugger - update to 25.3.2.6-11
erlang-debuginfo - update to 25.3.2.6-11
erlang-debugsource - update to 25.3.2.6-11
erlang-dialyzer - update to 25.3.2.6-11
erlang-inets - update to 25.3.2.6-11
erlang-edoc - update to 25.3.2.6-11
erlang-eldap - update to 25.3.2.6-11
erlang-erl_docgen - update to 25.3.2.6-11
erlang-erl_interface - update to 25.3.2.6-11
erlang-erts - update to 25.3.2.6-11
erlang-et - update to 25.3.2.6-11
erlang-eunit - update to 25.3.2.6-11
erlang-examples - update to 25.3.2.6-11
erlang-ftp - update to 25.3.2.6-11
erlang26-observer - update to 26.2.1-150300.7.22.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.22.1
erlang26-debugsource - update to 26.2.1-150300.7.22.1
erlang26-debugger - update to 26.2.1-150300.7.22.1
erlang26-epmd - update to 26.2.1-150300.7.22.1
erlang26-debugger-src - update to 26.2.1-150300.7.22.1
erlang26-jinterface-src - update to 26.2.1-150300.7.22.1
erlang26-observer-src - update to 26.2.1-150300.7.22.1
erlang26-reltool - update to 26.2.1-150300.7.22.1
erlang26-diameter - update to 26.2.1-150300.7.22.1
erlang26-dialyzer - update to 26.2.1-150300.7.22.1
erlang26-wx - update to 26.2.1-150300.7.22.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.22.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.22.1
erlang26-debuginfo - update to 26.2.1-150300.7.22.1
erlang26-reltool-src - update to 26.2.1-150300.7.22.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.22.1
erlang26-et - update to 26.2.1-150300.7.22.1
erlang26-wx-src - update to 26.2.1-150300.7.22.1
erlang26-diameter-src - update to 26.2.1-150300.7.22.1
erlang26-et-src - update to 26.2.1-150300.7.22.1
erlang26 - update to 26.2.1-150300.7.22.1
erlang26-jinterface - update to 26.2.1-150300.7.22.1
erlang26-doc - update to 26.2.1-150300.7.22.1
erlang26-src - update to 26.2.1-150300.7.22.1

• https://github.com/erlang/otp/security/advisories/GHSA-h7rg-6rjg-4cph

• Multiple vulnerabilities in otp
• Ubuntu update for erlang
• SUSE update for erlang26
• openEuler 24.03 LTS update for erlang
• openEuler 24.03 LTS SP3 update for erlang
• openEuler 24.03 LTS SP2 update for erlang
• openEuler 24.03 LTS SP1 update for erlang
• SUSE update for erlang