关键信息 漏洞标题 SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles 严重性 Severity: High (7.1/10) 影响范围 Affected versions: - OTP: >= 17.0 - ssh (OTP): >= 3.0.1 Patched versions: - OTP: 28.0.3, 27.3.4.3, 26.2.5.15 - ssh (OTP): 5.3.3, 5.2.11.3, 5.1.4.12 描述与影响 Impact: - Code handling SSH_FXP_OPENDIR operation does not allocate OS level file handle, but creates a file handle in Erlang VM. - This can lead to exhaustion of file handles and affect system stability. 解决方案与变通方法 Workarounds: - Disabling SFTP. - Limiting the number of max_sessions allowed for sshd. CVE ID CVE-2025-48041 弱点 Weaknesses: - CWE-400 - CWE-770 其他信息 CVSS v4 base metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: Low - User Interaction: None - Availability Impact: High