CVE-2025-30211CWE-789

KEX init error results with excessive memory usage

High · published March 28, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.8th percentile
Weakness
CWE-789 · Memory Allocation with Excessive Size Value
Published
2025-03-28T14:55Z
EPSS history
Timeline
  • 28 MAR 14:55Z
    KEX init error results with excessive memory usage
    cvelistv5