CNNVD-202509-1675 Information
CNNVD ID
CNNVD-202509-1675
Related CVE
- CNNVD Published: 2025-09-11
Description (Chinese)
Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 17.0版本至28.0.3版本、27.3.4.3版本和26.2.5.15版本存在安全漏洞，该漏洞源于lib/ssh/src/ssh_sftpd.erl文件中的资源消耗不受控制，可能导致过度分配和洪水攻击。
Description (English)
Erlang/OTP is a JavaScript repository for processing anomalies prepared by Erlang/OTP Open Source. The library captures anomalies caused by the API that is embedded in Node.js. Erlang/OTP version 17.0 to 28.0.3, 27.3.4.3 and 26.2.5.15 contain security loopholes stemming from uncontrolled resource consumption in lib/ssh/src/ssh sftpd.erl documents, which may lead to overallocation and flood attacks.
Hazard Level
High
Vulnerability Type
其他
Affected Vendor
Erlang/OTP
Published
2025-09-11
Last Modified
2026-02-24
References
https://github.com/erlang/otp/commit/548f1295d86d0803da884db8685cc16d461d0d5a https://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a https://github.com/erlang/otp/pull/10162 https://github.com/erlang/otp/security/advisories/GHSA-h7rg-6rjg-4cph https://www.erlang.org/doc/system/versions.html#order-of-versions
Patch
https://github.com/erlang/otp/releases
Share on: