CVE-2025-30211

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions prior to 27.3.1 Erlang/OTP versions prior to 26.2.5.10 Erlang/OTP versions prior to 25.3.2.19

Description A maliciously formed KEX init message can result in high memory usage due to the implementation not verifying RFC specified limits on algorithm names provided in the KEX init message. This can lead to inefficient processing of error data and a large amount of memory being allocated for processing malicious data.

Recommendations For versions prior to 27.3.1, update to version 27.3.1 or later. For versions prior to 26.2.5.10, update to version 26.2.5.10 or later. For versions prior to 25.3.2.19, update to version 25.3.2.19 or later. As a temporary workaround, consider setting the option parallel login to false and/or reducing the max sessions option to minimize the risk of exploitation.