Aller au contenu
en Se connecter
7.0 Élevée

CVE-2025-26618 Erlang is a programming language and runtime system for building massively scalable soft real-time systems with…

Description

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet size is not verified properly for SFTP packets. As a result when multiple SSH packets (conforming to max SSH packet size) are received by ssh, they might be combined into an SFTP packet which will exceed the max allowed packet size and potentially cause large amount of memory to be allocated. Note that situation described above can only happen for successfully authenticated users after completing the SSH handshake. This issue has been patched in OTP versions 27.2.4, 26.2.5.9, and 25.3.2.18. There are no known workarounds for this vulnerability.

Produits et versions touchés

Produit Versions touchées Corrigé en
otp Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de otp

Les 64 CVE de otp →
CVE-2026-96596 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm… 5.9 Moyenne CVE-2026-105236 Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a… 6.3 Moyenne CVE-2026-94200 Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and… 8.2 Élevée CVE-2026-65634 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated… 8.2 Élevée
Suivre cette CVE