7.5
High
CVE-2025-30211 Erlang/OTP is a set of libraries for the Erlang programming language
Description
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| otp | Versions not published |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of otp
The 64 CVEs of otp →
CVE-2026-96596
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm…
5.9
Medium
CVE-2026-105236
Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a…
6.3
Medium
CVE-2026-94200
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and…
8.2
High
CVE-2026-65634
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated…
8.2
High