BSD Ports

Erlang -- Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

· CVE-2025-32433 · VuXML entry

[email protected] reports: Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands …

Affected versions

By system

4 still vulnerable, 6 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.

SystemPortVersionStateFixed
DragonFlylang/erlang25.3.2.7_1,4 fixed
NetBSDlang/erlang27.3.4.7 not listed
MidnightBSDlang/erlang25.3.2.20_1,4 in range, by version
FreeBSDlang/erlang28.5.0.8_1,4 fixed (464 days after)
DragonFlylang/erlang-runtime2121.3.8.24_5 vulnerable since 2025-04-20
MidnightBSDlang/erlang-runtime2121.3.8.24_2 in range, by version
DragonFlylang/erlang-runtime2222.3.4.27_1 vulnerable since 2025-04-20
MidnightBSDlang/erlang-runtime2222.3.4.27_2 in range, by version
DragonFlylang/erlang-runtime2323.3.4.20_3 vulnerable since 2025-04-20
DragonFlylang/erlang-runtime2424.3.4.14_1 vulnerable since 2025-04-20
MidnightBSDlang/erlang-runtime2424.3.4.17_2 in range, by version
DragonFlylang/erlang-runtime2525.3.2.21 fixed
MidnightBSDlang/erlang-runtime2525.3.2.21_1 out of range, by version
DragonFlylang/erlang-runtime2626.2.5.12 fixed
MidnightBSDlang/erlang-runtime2626.2.5_2 in range, by version
DragonFlylang/erlang-runtime2727.3.4 fixed
FreeBSDlang/erlang-runtime2727.3.4.19_1 fixed (464 days after)