rpm package
opensuse/erlang26&distro=openSUSE Leap 15.6
pkg:rpm/opensuse/erlang26&distro=openSUSE%20Leap%2015.6
Vulnerabilities (13)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-48041 | Hig | — | < 26.2.1-150300.7.19.1 | 26.2.1-150300.7.19.1 | Sep 11, 2025 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OT | |
| CVE-2025-48040 | Med | — | < 26.2.1-150300.7.22.1 | 26.2.1-150300.7.22.1 | Sep 11, 2025 | Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2 | |
| CVE-2025-48039 | Med | — | < 26.2.1-150300.7.22.1 | 26.2.1-150300.7.22.1 | Sep 11, 2025 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until | |
| CVE-2025-48038 | Med | — | < 26.2.1-150300.7.22.1 | 26.2.1-150300.7.22.1 | Sep 11, 2025 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until | |
| CVE-2025-4748 | Med | — | < 26.2.1-150300.7.14.3 | 26.2.1-150300.7.14.3 | Jun 16, 2025 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip | |
| CVE-2025-32433 | — | KEV | < 26.2.1-150300.7.11.1 | 26.2.1-150300.7.11.1 | Apr 16, 2025 | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, | |
| CVE-2025-30211 | Hig | 7.5 | < 26.2.1-150300.7.11.1 | 26.2.1-150300.7.11.1 | Mar 28, 2025 | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 charac | |
| CVE-2025-26618 | Hig | — | < 26.2.1-150300.7.8.1 | 26.2.1-150300.7.8.1 | Feb 20, 2025 | Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in | |
| CVE-2023-46118 | — | < 26.2.1-150300.7.5.1 | 26.2.1-150300.7.5.1 | Oct 24, 2023 | RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages | ||
| CVE-2022-31008 | — | < 26.2.1-150300.7.5.1 | 26.2.1-150300.7.5.1 | Oct 6, 2022 | RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of ce | ||
| CVE-2021-32719 | — | < 26.2.1-150300.7.5.1 | 26.2.1-150300.7.5.1 | Jun 28, 2021 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper tag sanitization. T | ||
| CVE-2021-32718 | — | < 26.2.1-150300.7.5.1 | 26.2.1-150300.7.5.1 | Jun 28, 2021 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `` tag sanitization, potentially allowing for JavaScri | ||
| CVE-2021-22116 | — | < 26.2.1-150300.7.5.1 | 26.2.1-150300.7.5.1 | Jun 8, 2021 | RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having t |
- affected < 26.2.1-150300.7.19.1fixed 26.2.1-150300.7.19.1
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OT
- affected < 26.2.1-150300.7.22.1fixed 26.2.1-150300.7.22.1
Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2
- affected < 26.2.1-150300.7.22.1fixed 26.2.1-150300.7.22.1
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until
- affected < 26.2.1-150300.7.22.1fixed 26.2.1-150300.7.22.1
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until
- affected < 26.2.1-150300.7.14.3fixed 26.2.1-150300.7.14.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip
- affected < 26.2.1-150300.7.11.1fixed 26.2.1-150300.7.11.1
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling,
- affected < 26.2.1-150300.7.11.1fixed 26.2.1-150300.7.11.1
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 charac
- affected < 26.2.1-150300.7.8.1fixed 26.2.1-150300.7.8.1
Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in
- CVE-2023-46118Oct 24, 2023affected < 26.2.1-150300.7.5.1fixed 26.2.1-150300.7.5.1
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages
- CVE-2022-31008Oct 6, 2022affected < 26.2.1-150300.7.5.1fixed 26.2.1-150300.7.5.1
RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of ce
- CVE-2021-32719Jun 28, 2021affected < 26.2.1-150300.7.5.1fixed 26.2.1-150300.7.5.1
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper tag sanitization. T
- CVE-2021-32718Jun 28, 2021affected < 26.2.1-150300.7.5.1fixed 26.2.1-150300.7.5.1
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `` tag sanitization, potentially allowing for JavaScri
- CVE-2021-22116Jun 8, 2021affected < 26.2.1-150300.7.5.1fixed 26.2.1-150300.7.5.1
RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having t