CVE-2025-30211: KEX init error results with excessive memory usage
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option parallellogin to false and/or reduce the maxsessions option.
Other sources
KEX init error results with excessive memory usage
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/erlangto a version that resolves this vulnerability.Fixed in 1:27.3.1+dfsg-1Fixed in 1:27.3.2+dfsg-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.2-4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.5.10-1 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in OTP-27.3.1 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in OTP-26.2.5.10 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in OTP-25.3.2.19 - Configuration
Set option `parallel_login` to `false` to mitigate excessive memory usage from a maliciously formed KEX init message.
Erlang/OTP parallel_login = false - Configuration
Reduce the `max_sessions` option to mitigate excessive memory usage from a maliciously formed KEX init message.
Erlang/OTP max_sessions = reduced
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30211?
CVE-2025-30211 is considered a high-severity vulnerability due to its potential impact on memory usage and denial of service.
How do I fix CVE-2025-30211?
To fix CVE-2025-30211, upgrade to Erlang/OTP version OTP-27.3.1, 26.2.5.10, or 25.3.2.19 or later.
What versions of Erlang/OTP are affected by CVE-2025-30211?
CVE-2025-30211 affects versions of Erlang/OTP prior to OTP-27.3.1, 26.2.5.10, and 25.3.2.19.
How does CVE-2025-30211 affect the performance of applications?
CVE-2025-30211 can lead to high memory usage by applications using affected versions of Erlang/OTP, potentially causing slowdowns or crashes.
Is CVE-2025-30211 a remote code execution vulnerability?
CVE-2025-30211 is not a remote code execution vulnerability but can lead to denial of service due to excessive resource consumption.