AZL-59358

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-59358.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-59358

Upstream

CVE-2025-30211

Published

2025-03-28T15:15:50Z

Modified

2026-04-01T05:19:28.177951Z

Summary

CVE-2025-30211 affecting package erlang for versions less than 26.2.5.10-1

Details

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option parallel_login to false and/or reduce the max_sessions option.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-30211

Affected packages

Azure Linux:3 / erlang

Package

Name: erlang
Purl: pkg:rpm/azure-linux/erlang

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

26.2.5.10-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-59358.json"