Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-7443-1 1 CVE

erlang vulnerability

Published Apr 17, 2025 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Fabian Bäumer, Marcel Maehren, Marcus Brinkmann, and Jörg Schwenk
discovered that Erlang OTP’s SSH module incorrect handled authentication. A
remote attacker could use this issue to execute arbitrary commands without
authentication, possibly leading to a system compromise.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS erlang 1:22.2.7+dfsg-1ubuntu0.5
Ubuntu · 22.04 LTS 22.04:LTS erlang 1:24.2.1+dfsg-1ubuntu0.4
Ubuntu · 24.04 LTS 24.04:LTS erlang 1:25.3.2.8+dfsg-1ubuntu4.3

Vulnerabilities 1

  • Critical 10.0
    CVE-2025-32433 Exploited Public exploit EPSS 99%

    Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

    Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protoc…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux Alpine
    KEV Jun 9, 2025

References

  • report
    https://ubuntu.com/security/CVE-2025-32433