CVE-2025-46712

Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake. This issue has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25).

• CWE-440

• https://github.com/erlang/otp/commit/e4b56a9f4a511aa9990dd86c16c61439c828df83
• https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21
• https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12
• https://github.com/erlang/otp/releases/tag/OTP-27.3.4
• https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf

Published

May 8, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46707Software installed and running inside a Guest VM may overrid…5.2
• CVE-2025-46708Software installed and running inside a Guest VM may conduct…4.3
• CVE-2025-46709Possible memory leak or kernel exceptions caused by reading …7.5
• CVE-2025-4671The Profile Builder plugin for WordPress is vulnerable to St…6.4
• CVE-2025-46710Possible kernel exceptions caused by reading and writing ker…5.7
• CVE-2025-46711Software installed and run as a non-privileged user may cond…5.5
• CVE-2025-46713Sandboxie is a sandbox-based isolation software for 32-bit a…7.8
• CVE-2025-46714Sandboxie is a sandbox-based isolation software for 32-bit a…7.8
• CVE-2025-46715Sandboxie is a sandbox-based isolation software for 32-bit a…7.8
• CVE-2025-46716Sandboxie is a sandbox-based isolation software for 32-bit a…5.5
• CVE-2025-46717sudo-rs is a memory safe implementation of sudo and su writt…3.3
• CVE-2025-46718sudo-rs is a memory safe implementation of sudo and su writt…3.3