Security readout for executives and security teams
Plain-English summary
CVE-2025-48041 is a denial-of-service flaw in Erlang/OTP's SSH SFTP server. An authenticated network user can cause excessive file-handle allocation through directory-open requests, potentially exhausting resources and disrupting the affected service.
Executive priority
Treat this as a high-priority availability risk for systems using Erlang/OTP's SFTP server. It is less urgent for environments without that component exposed, but internet-facing or multi-user SFTP services should be reviewed promptly.
Technical view
The Erlang/OTP ssh_sftp implementation in lib/ssh/src/ssh_sftpd.erl lacks sufficient resource limiting for SSH_FXP_OPENDIR handling. The CVSS 4.0 score is 7.1, with low attack complexity, required privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is most likely where Erlang/OTP applications enable the built-in SSH/SFTP server and allow authenticated users to reach it over the network. Affected ranges are reported from OTP 17.0 until the vendor-listed fixed lines around OTP 28.0.3, 27.3.4.3, and 26.2.5.15.
Exploitation context
The source bundle does not show KEV listing or confirmed active exploitation. The issue is still operationally important because exploitation requires only network access and valid credentials, and the expected impact is service availability loss rather than data theft.
Researcher notes
Available evidence supports CWE-400 and CWE-770 resource exhaustion in ssh_sftpd.erl via SSH_FXP_OPENDIR handling. The bundle includes vendor advisory, CNA and OSV records, and patch PR/commit references, but no public exploitation confirmation.
Mitigation direction
- Upgrade Erlang/OTP ssh according to the Erlang advisory and patch references.
- Prioritize systems exposing Erlang SSH/SFTP to untrusted or broad user populations.
- Restrict SFTP access to trusted networks and necessary authenticated users.
- Monitor file-handle usage and service availability on exposed Erlang SSH/SFTP hosts.
- Check vendor guidance before applying compensating controls not named in the advisory.
Validation and detection
- Inventory applications using Erlang/OTP ssh or ssh_sftp modules.
- Identify deployed OTP and ssh application versions on each system.
- Confirm whether Erlang SSH/SFTP services are enabled and reachable.
- Review authentication scope for users allowed to access SFTP.
- Verify patched builds include the referenced Erlang/OTP fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-48041 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——EEFVulnerability scoring details
Base CVSS 4.0 score
7.1HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3CVE reference, EEF · vendor-advisory, related
- https://cna.erlef.org/cves/CVE-2025-48041.htmlCVE reference, EEF · related
- https://osv.dev/vulnerability/EEF-CVE-2025-48041CVE reference, EEF · related
- https://www.erlang.org/doc/system/versions.html#order-of-versionsCVE reference, EEF · x_version-scheme
- https://github.com/erlang/otp/pull/10157CVE reference, EEF · patch
- https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288CVE reference, EEF · patch
- https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401CVE reference, EEF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.