Erlang/OTP (Erlang OTP) DoS Vulnerability (Feb 2025) - Linux

Erlang/OTP Erlang OTP is prone to a denial of service DoS vulnerability in the SSH component. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

SUSE-SU-2025:1356-1 Security update for erlang26

This update for erlang26 fixes the following issues: - CVE-2025-30211: Fixed KEX init error results with excessive memory usage bsc1240390 - CVE-2025-32433: Fixed unauthenticated remote code execution in Erlang/OTP SSH bsc1241300...

FreeBSD : Erlang -- Erlang/OTP SSH Vulnerable to Pre-Authentication RCE (06269ae8-1e0d-11f0-ad0b-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 06269ae8-1e0d-11f0-ad0b-b42e991fc52e advisory. [email protected] reports: Erlang/OTP is a set of libraries for the Erlang programming...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

CVE-2025-32433 Remote Shell Go-based exploit for CVE-2025-3243...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC The vulnerability allows...

The vulnerability of the SSH protocol implementation in the Erlang/OTP library lies in the lack of authentication checks for a critical function, allowing attackers to execute arbitrary code.

The vulnerability of the SSH protocol implementation in the Erlang/OTP library set is related to the lack of authentication checks for a critical function. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code by sending specially crafted SSH packets...

Erlang/OTP SSH RCE (OTP-19595)

The Erlang/OTP SSH applicaiton installed on the remote host is 4.15.x 4.15.3.12, 5.1.x 5.1.4.8, 5.2.x 5.2.10. Therefore, it is affected by a remote code execution vulnerability due to a flaw in the SSH protocol message handling. An unauthenticated, remote attacker can exploit this to bypass...

AZL-60583 CVE-2025-32433 affecting package erlang for versions less than 25.3.2.20-1

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a malicious actor...

CVE-2025-32433

The CVE-2025-32433 issue affects Erlang/OTP’s SSH server and is caused by a flaw in SSH message handling during authentication, enabling an unauthenticated attacker to execute arbitrary commands with the SSH daemon’s privileges (potentially root). Affected OTP versions include OTP-27.3.2?3, OTP-2...

CVE-2025-32433

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a malicious actor...

CVE-2025-32433

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a malicious actor...

SUSE-SU-2025:20184-1 Security update for elemental-operator

This update for elemental-operator fixes the following issues: - Updated to version 1.6.8: Deactivated e2e workflow Updated header year CVE-2025-22870: golang.org/x/net/proxy: Fixed proxy bypass using IPv6 zone IDs bsc1238700 CVE-2025-22869: golang.org/x/crypto/ssh: Fixed Denial of Service in the...

CVE-2025-32754

In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SS...

CVE-2024-41793

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices provides an endpoint that allows to enable the ssh service without authentication. This could allow an unauthenticated remote attacker to enable remote access to the device...

SSH Prefix Truncation Vulnerability (Terrapin attack) on Citrix Applayering

SSH Prefix Truncation Vulnerability Terrapin attack on Citrix App Layering . Note: The Terrapin attack can reduce the security of SSH by using a downgrade attack via man-in-the-middle interception. The attack works by prefix truncation; the injection and deletion of messages during feature...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-914)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-914 advisory. SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to b...

Important: runfinch-finch

Issue Overview: SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. CVE-2025-22869 Go JOSE provides an...

PT-2025-13781 · Vyos +2 · Vyos +2

Name of the Vulnerable Software and Affected Versions: VyOS versions 1.3 through 1.5 Description: The issue allows an attacker to conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon, due to the same Dropbear private host keys being used across...

CVE-2024-21865

HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell...

Security update for buildah

This update for buildah fixes the following issues: CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh bsc1239339. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...