7.5
Élevée
CVE-2025-30211 Erlang/OTP is a set of libraries for the Erlang programming language
Description
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| otp | Versions non publiées |
Autres CVE de otp
Les 64 CVE de otp →
CVE-2026-96596
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm…
5.9
Moyenne
CVE-2026-105236
Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a…
6.3
Moyenne
CVE-2026-94200
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and…
8.2
Élevée
CVE-2026-65634
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated…
8.2
Élevée