Erlang/OTP Security Fix: CVE-2025-46712 SSH Strict Key Exchange and Simulator Crash Fixes

Critical Vulnerability Information Vulnerability IDs and Related Issues CVE-2025-46712: Related to OTP-19625, fixes an issue with SSH strict implementation. ERIERL-1220, PR-9966: Related to OTP-19577, fixes a crash in the emulator when setting an error handler module that is not yet loaded. PR-9724: Related to OTP-19599, fixes a rare bug that could cause the emulator to crash after unloading a module or erasing a persistent item. Applications and Versions erts-13.2.2.16: Includes dependencies such as kernel-8.5, sasl-3.3, stdlib-4.1. kernel-8.5.4.6: Includes dependencies such as crypto-5.0, erts-13.1.3, sasl-3.0, stdlib-4.1.1. ssh-4.15.3.13: Includes dependencies such as crypto-5.0, erts-11.0, kernel-6.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-3.15. Fixes Applied OTP-19577: Fixes a crash in the emulator when setting an error handler module that is not yet loaded. OTP-19599: Fixes a rare bug that could cause the emulator to crash after unloading a module or erasing a persistent item. OTP-19605: Fixes an issue where disk_log would not crash when log size decreased after using chunk_step/3. OTP-19608: Fixes an issue where disk_log would not enter an infinite loop when log size decreased after using chunk/2,3. OTP-19625: Fixes SSH strict implementation according to draft-miller-sshm-strict-kex-01. Notes Applications erts-13.2.2.16 and kernel-8.5.4.6 cannot be applied independently to any OTP 25 installation without other applications. In a complete OTP 25 installation, specific runtime dependencies must be satisfied.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP Security Fix: CVE-2025-46712 SSH Strict Key Exchange and Simulator Crash Fixes

More from this source