CVE-2025-46712lowCWE-440

CVE-2025-46712: low-severity vulnerability in erlang otp

Erlang/OTP SSH Has Strict KEX Violations

Published · Updated

Follow this CVE+ Monitor OTP+ Monitor erlang

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.6%
Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake. This issue has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25).
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
erlang · otp
Related CVEs — erlang otp

In the same product, most dangerous first.

CVE-2025-32433CRITICALErlang/OTP SSH Vulnerable to Pre-Authentication RCEEPSS 98.9%KEVCVE-2025-26618HIGHSSH SFTP packet size not verified properly in Erlang OTPEPSS 0.5%CVE-2025-30211HIGHKEX init error results with excessive memory usageEPSS 0.5%CVE-2024-53846MEDIUMssl fails to validate incorrect extened key usageEPSS 0.3%