p PatchFirst

CVE-2025-30211

CVE-2025-30211 · KEX init error results with excessive memory usage

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option.

CVSS 7.5 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • erlang

    Versions
    • < OTP-27.3.1: Affected
    • < OTP-26.2.5.10: Affected
    • < OTP-25.3.2.19: Affected

    No fix published

  • erlang Debian:12

    Versions
    • 1:25.2.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 1:25.2.3+dfsg-1+deb12u1

    Update to 1:25.2.3+dfsg-1+deb12u1

  • erlang Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:27.3.1+dfsg-1

    Update to 1:27.3.1+dfsg-1

  • erlang Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:27.3.1+dfsg-1

    Update to 1:27.3.1+dfsg-1

  • erlang Ubuntu:Pro:14.04:LTS

    Versions
    • 1:16.b.1-dfsg-4ubuntu1
    • 1:16.b.2-dfsg-1ubuntu1
    • 1:16.b.2-dfsg-2ubuntu1
    • 1:16.b.3-dfsg-1ubuntu1
    • 1:16.b.3-dfsg-1ubuntu2
    • 1:16.b.3-dfsg-1ubuntu2.1
    • 1:16.b.3-dfsg-1ubuntu2.2
    • 1:16.b.3-dfsg-1ubuntu2.2+esm1
    • 1:16.b.3-dfsg-1ubuntu2.2+esm2
    Affected ranges
    • ECOSYSTEM: < 1:16.b.3-dfsg-1ubuntu2.2+esm3

    Update to 1:16.b.3-dfsg-1ubuntu2.2+esm3

  • erlang Ubuntu:Pro:16.04:LTS

    Versions
    • 1:18.0-dfsg-1ubuntu1
    • 1:18.0-dfsg-1ubuntu2
    • 1:18.2-dfsg-2ubuntu1
    • 1:18.3-dfsg-1ubuntu1
    • 1:18.3-dfsg-1ubuntu2
    • 1:18.3-dfsg-1ubuntu3
    • 1:18.3-dfsg-1ubuntu3.1
    • 1:18.3-dfsg-1ubuntu3.1+esm1
    • 1:18.3-dfsg-1ubuntu3.1+esm2
    • 1:18.3-dfsg-1ubuntu3.1+esm3
    Affected ranges
    • ECOSYSTEM: < 1:18.3-dfsg-1ubuntu3.1+esm4

    Update to 1:18.3-dfsg-1ubuntu3.1+esm4

  • erlang Ubuntu:Pro:18.04:LTS

    Versions
    • 1:20.0.4+dfsg-1ubuntu1
    • 1:20.1.2+dfsg-1ubuntu1
    • 1:20.1.3+dfsg-1ubuntu1
    • 1:20.1.4+dfsg-1ubuntu1
    • 1:20.1.5+dfsg-1ubuntu1
    • 1:20.1.6+dfsg-1ubuntu1
    • 1:20.1.7+dfsg-1ubuntu1
    • 1:20.2.1+dfsg-1ubuntu1
    • 1:20.2.2+dfsg-1ubuntu1
    • 1:20.2.2+dfsg-1ubuntu2
    • 1:20.2.2+dfsg-1ubuntu2+esm1
    • 1:20.2.2+dfsg-1ubuntu2+esm2
    • 1:20.2.2+dfsg-1ubuntu2+esm3
    Affected ranges
    • ECOSYSTEM: < 1:20.2.2+dfsg-1ubuntu2+esm4

    Update to 1:20.2.2+dfsg-1ubuntu2+esm4

  • erlang Ubuntu:20.04:LTS

    Versions
    • 1:22.0.7+dfsg-1build1
    • 1:22.2+dfsg-1
    • 1:22.2.1+dfsg-1
    • 1:22.2.2+dfsg-1
    • 1:22.2.3+dfsg-1
    • 1:22.2.3+dfsg-2
    • 1:22.2.4+dfsg-1
    • 1:22.2.7+dfsg-1
    • 1:22.2.7+dfsg-1ubuntu0.2
    • 1:22.2.7+dfsg-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 1:22.2.7+dfsg-1ubuntu0.4

    Update to 1:22.2.7+dfsg-1ubuntu0.4

  • erlang Ubuntu:22.04:LTS

    Versions
    • 1:23.2.6+dfsg-1build1
    • 1:24.1.1+dfsg-1
    • 1:24.1.4+dfsg-1
    • 1:24.1.5+dfsg-1
    • 1:24.1.5+dfsg-1ubuntu1
    • 1:24.2+dfsg-1
    • 1:24.2.1+dfsg-1
    • 1:24.2.1+dfsg-1ubuntu0.1
    • 1:24.2.1+dfsg-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 1:24.2.1+dfsg-1ubuntu0.3

    Update to 1:24.2.1+dfsg-1ubuntu0.3

  • erlang Ubuntu:24.04:LTS

    Versions
    • 1:25.2.3+dfsg-1
    • 1:25.3.2.8+dfsg-1
    • 1:25.3.2.8+dfsg-1ubuntu1
    • 1:25.3.2.8+dfsg-1ubuntu3
    • 1:25.3.2.8+dfsg-1ubuntu4
    • 1:25.3.2.8+dfsg-1ubuntu4.1
    Affected ranges
    • ECOSYSTEM: < 1:25.3.2.8+dfsg-1ubuntu4.2

    Update to 1:25.3.2.8+dfsg-1ubuntu4.2

  • erlang Ubuntu:25.10

    Affected ranges
    • ECOSYSTEM: < 1:27.3+dfsg-1ubuntu1

    Update to 1:27.3+dfsg-1ubuntu1

Original sources

Check your server →