High severity · published Mar 28, 2025
CVE-2025-30211
KEX init error results with excessive memory usage
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OT
otp · erlang
< OTP-27.3.1; < OTP-26.2.5.10; < OTP-25.3.2.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30211
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30211
github.com
https://github.com/erlang/otp/security/advisories/GHSA-vvr3-fjhh-cfwc
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html
More from otp
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
7.0
CVE-2025-26618
SSH SFTP packet size not verified properly in Erlang OTP
5.5
CVE-2024-53846
ssl fails to validate incorrect extened key usage
3.7
CVE-2025-46712
Erlang/OTP SSH Has Strict KEX Violations