CVE-2025-32433

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

References

Affected packages

Git /

Affected ranges

Database specific

{
    "unresolved_versions": [
        {
            "events": [
                {
                    "introduced": "OTP-27.0-rc1"
                },
                {
                    "fixed": "OTP-27.3.3"
                }
            ],
            "type": ""
        },
        {
            "events": [
                {
                    "introduced": "OTP-26.0-rc1"
                },
                {
                    "fixed": "OTP-26.2.5.11"
                }
            ],
            "type": ""
        },
        {
            "events": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "OTP-25.3.2.20"
                }
            ],
            "type": ""
        }
    ]
}