PatchTheCVEerlang\/ssh vulnerabilities and fixes
Recent CVEs affecting erlang\/ssh, with upgrade or downgrade steps. 3 tracked.
erlang\/ssh has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-07-02. Highest priority: CVE-2026-48855 (score 28/100).
- CVE-2026-48855 MEDIUM 6.5 UPGRADE UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module)
- CVE-2026-54886 MEDIUM 4.3 UPGRADE UPGRADE Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allo
- CVE-2026-53422 MEDIUM 4.3 UPGRADE UPGRADE Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFT
FAQ
How do I fix erlang\/ssh vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is erlang\/ssh being exploited right now?
None of the tracked erlang\/ssh CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which erlang\/ssh CVE should I patch first?
CVE-2026-48855 currently ranks highest (28/100): Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) .