CVE-2025-30211

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-30211
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30211.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30211
Aliases
  • GHSA-vvr3-fjhh-cfwc
Related
Published
2025-03-28T15:15:50Z
Modified
2025-04-21T01:59:52.420601Z
Downstream
Summary
[none]
Details

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option parallel_login to false and/or reduce the max_sessions option.

References

Affected packages

Debian:11 / erlang

Package

Name
erlang
Purl
pkg:deb/debian/erlang?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:23.2.6+dfsg-1+deb11u2

Affected versions

1:23.*

1:23.2.6+dfsg-1
1:23.2.6+dfsg-1+deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / erlang

Package

Name
erlang
Purl
pkg:deb/debian/erlang?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:25.2.3+dfsg-1+deb12u1

Affected versions

1:25.*

1:25.2.3+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / erlang

Package

Name
erlang
Purl
pkg:deb/debian/erlang?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:27.3.1+dfsg-1

Affected versions

1:25.*

1:25.2.3+dfsg-1
1:25.3.2.8+dfsg-1
1:25.3.2.10+dfsg-1
1:25.3.2.10+dfsg-2
1:25.3.2.11+dfsg-1
1:25.3.2.12+dfsg-1
1:25.3.2.12+dfsg-2
1:25.3.2.12+dfsg-3

1:26.*

1:26.0~rc2+dfsg-1
1:26.0~rc3+dfsg-1
1:26.0+dfsg-1
1:26.0.1+dfsg-1
1:26.0.2+dfsg-1
1:26.1.2+dfsg-1
1:26.2.1+dfsg-1
1:26.2.4+dfsg-1

1:27.*

1:27.0~rc3+dfsg-1
1:27.0~rc3+dfsg-2
1:27.0~rc3+dfsg-3
1:27.0~rc3+dfsg-4
1:27.0+dfsg-1
1:27.0.1+dfsg-1
1:27.0.1+dfsg-2
1:27.0.1+dfsg-3
1:27.1.2+dfsg-1
1:27.2+dfsg-1
1:27.2+dfsg-2
1:27.2+dfsg-3~exp1
1:27.2.1+dfsg-1
1:27.2.1+dfsg-2
1:27.2.2+dfsg-1
1:27.2.3+dfsg-1
1:27.2.4+dfsg-1
1:27.3+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}