CNNVD-202509-1676 Information
CNNVD ID
CNNVD-202509-1676
Related CVE
- CNNVD Published: 2025-09-11
Description (Chinese)
Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 17.0版本至28.0.3版本、27.3.4.3版本和26.2.5.15版本存在安全漏洞，该漏洞源于lib/ssh/src/ssh_sftpd.erl中资源分配无限制或节流，可能导致资源过度分配和资源泄露。
Description (English)
Erlang/OTP is a JavaScript repository for processing anomalies prepared by Erlang/OTP Open Source. The library captures anomalies caused by the API that is embedded in Node.js. Erlang/OTP version 17.0 to 28.0.3, version 27.3.4 and version 26.2.5.15 contain a security loophole, which stems from the unrestricted or no-go distribution of resources in lib/ssh/src/ssh sftpd.erl and may lead to overallocation and leakage of resources.
Hazard Level
High
Vulnerability Type
其他
Affected Vendor
Erlang/OTP
Published
2025-09-11
Last Modified
2026-02-24
References
https://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f https://github.com/erlang/otp/pull/10156 https://github.com/erlang/otp/security/advisories/GHSA-pvj7-9652-7h9r https://www.erlang.org/doc/system/versions.html#order-of-versions
Patch
https://www.erlang.org/downloads
Share on: