CNNVD-202509-1673 Information
CNNVD ID
CNNVD-202509-1673
Related CVE
- CNNVD Published: 2025-09-11
Description (Chinese)
Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 17.0版本至28.0.3版本、27.3.4.3版本和26.2.5.15版本存在安全漏洞，该漏洞源于lib/ssh/src/ssh_sftpd.erl中资源分配无限制，可能导致资源过度分配和洪水攻击。
Description (English)
Erlang/OTP is a JavaScript repository for processing anomalies prepared by Erlang/OTP Open Source. The library captures anomalies caused by the API that is embedded in Node.js. Erlang/OTP version 17.0 to 28.0.3, 27.3.4 and 26.2.5.15 contain security loopholes stemming from unrestricted resource allocation in lib/ssh/src/ssh sftpd.erl, which may lead to overallocation of resources and flooding attacks.
Hazard Level
High
Vulnerability Type
其他
Affected Vendor
Erlang/OTP
Published
2025-09-11
Last Modified
2026-02-24
References
https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288 https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401 https://github.com/erlang/otp/pull/10157 https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3 https://www.erlang.org/doc/system/versions.html#order-of-versions
Patch
https://github.com/erlang/otp/releases
Share on: