CVE-2025-48039: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-48039 is an uncontrolled resource consumption vulnerability in the Erlang OTP SSH SFTP server (ssh_sftpd module) that allows authenticated users to cause excessive CPU and memory usage by supplying unverified, arbitrarily long path values. The vulnerability resides in lib/ssh/src/ssh_sftpd.erl and affects Erlang OTP versions from 17.0 up to (but not including) OTP 28.0.3, 27.3.4.3, and 26.2.5.15, corresponding to SSH library versions 3.0.1 through 5.3.3, 5.2.11.3, and 5.1.4.12. It was published on September 11, 2025, with patched versions released the same day. The CVSS v3.1 base score is 4.3 (Medium) and the CVSS v4.0 base score is 5.3 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The ssh_sftpd.erl module failed to validate or limit the length of file paths supplied by SFTP clients in operations such as SSH_FXP_OPEN, SSH_FXP_STAT, SSH_FXP_MKDIR, SSH_FXP_RENAME, SSH_FXP_SYMLINK, and others. An authenticated SFTP user could send requests containing arbitrarily long path strings, causing the server to allocate excessive CPU and memory resources when processing them. The fix introduced a configurable max_path option (defaulting to 4096 bytes) that rejects any path exceeding the limit with an SSH_FX_NO_SUCH_PATH error before further processing occurs (GitHub PR #10155, Commit c242e64).

Successful exploitation can degrade or destabilize the availability of the affected Erlang SSH SFTP server by causing excessive CPU and memory consumption, potentially leading to denial of service for legitimate users. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Because exploitation requires prior authentication (low-privilege SFTP access), the attack surface is constrained to users who already have valid credentials, limiting the risk of unauthenticated mass exploitation (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.045% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege authenticated access to the SFTP service, which raises the bar compared to unauthenticated vulnerabilities (GitHub Advisory, Red Hat).

1. Obtain SFTP credentials: Acquire valid SSH/SFTP credentials for the target Erlang OTP SFTP server (e.g., through credential theft, brute force, or a legitimate low-privilege account).
2. Connect to the SFTP service: Establish an SFTP session to the vulnerable server using any standard SFTP client or library.
3. Craft oversized path requests: Send SFTP protocol requests (e.g., SSH_FXP_OPEN, SSH_FXP_STAT, SSH_FXP_MKDIR) containing path strings significantly exceeding 4096 bytes — for example, a filename composed of thousands of repeated characters.
4. Trigger resource exhaustion: Repeatedly send such requests in rapid succession; the server processes each oversized path without bounds checking, consuming increasing amounts of CPU and memory.
5. Achieve denial of service: Sustained submission of oversized path requests degrades server performance or causes it to become unresponsive to legitimate SFTP users (GitHub Advisory, GitHub PR #10155).

• Network: Unusual volume of SFTP requests from a single authenticated user or source IP; SFTP sessions with abnormally large request payloads observable in packet captures on port 22.
• Logs: SSH daemon logs showing repeated SFTP subsystem requests with extremely long path strings; error messages or warnings related to resource limits in Erlang/OTP application logs.
• Process/System: Elevated CPU or memory consumption by the Erlang beam.smp process handling SSH connections; system resource monitors showing sustained spikes correlated with SFTP activity.
• Application: Erlang crash dumps or OOM (out-of-memory) events associated with the ssh_sftpd process (GitHub Advisory).

Upgrade to one of the patched Erlang OTP versions: 28.0.3, 27.3.4.3, or 26.2.5.15 (corresponding to SSH library versions 5.3.3, 5.2.11.3, and 5.1.4.12 respectively). If immediate upgrade is not possible, two workarounds are available: (1) disable the SFTP subsystem entirely if it is not required, or (2) limit the number of concurrent SSH sessions using the max_sessions option for sshd, making exploitation more difficult. Additionally, administrators can configure the new max_path option (introduced in the fix) to restrict path lengths accepted from SFTP clients (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received routine coverage across Linux distribution security channels, with Debian (including LTS), Ubuntu, openSUSE, and SUSE issuing security updates for their Erlang packages. Microsoft also acknowledged the vulnerability in the context of Azure Linux (CBL-Mariner) packages. Community discussion on the Elixir Forum noted the patch releases for OTP 26.2.5.15, 27.3.4.3, and 28.0.3 shortly after disclosure. No significant independent researcher commentary or media coverage beyond standard vulnerability tracking was observed (GitHub Advisory, Microsoft MSRC).