Skip to content
OpenAdvisories
High USN-7425-1 1 CVE

erlang vulnerability

Published Apr 8, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Erlang OTP's SSH module did not limit the size of
certain data in initialization messages. An attacker could possibly use
this issue to consume large amount of memory leading to a denial of
service.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS erlang 1:22.2.7+dfsg-1ubuntu0.4
Ubuntu · 22.04 LTS 22.04:LTS erlang 1:24.2.1+dfsg-1ubuntu0.3
Ubuntu · 24.04 LTS 24.04:LTS erlang 1:25.3.2.8+dfsg-1ubuntu4.2

Vulnerabilities 1

  • High 7.5
    CVE-2025-30211

    KEX init error results with excessive memory usage

    Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algor…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2025-30211