SFTP Packet Size Vulnerability in Erlang's OTP Runtime System

CVE-2025-26618

What is CVE-2025-26618?

Erlang's OTP runtime system is susceptible to a packet size handling vulnerability that can be exploited by authenticated users. When multiple SSH packets are processed together, they may be incorrectly combined into an SFTP packet, leading to a situation where the resultant packet exceeds the maximum allowed size. This inappropriate handling can result in excessive memory allocation, thereby posing risks of denial-of-service for affected applications. The issue arises only after successful authentication following the SSH handshake, making it critical for users to update to the patched versions to mitigate potential threats. No workarounds are available for this vulnerability.

References