Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C H H H 10.0 .9879 99.9 YES
AFFECTED Product Versions Fixed otp >= OTP-27.0-rc1, < OTP-27.3.3 – —
TIMELINE Apr 8 Reserved by GitHub_M Apr 16 Published (CNA: GitHub_M) Jun 9 Added to CISA KEV, remediation due 2025-06-30
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
| Date | Event | Detail |
|---|---|---|
| April 8, 2025 | Reserved | Reserved by GitHub_M |
| April 16, 2025 | Published | Published (CNA: GitHub_M) |
| June 9, 2025 | KEV ADDED | Added to CISA KEV, remediation due 2025-06-30 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| erlang | otp | — | >= OTP-27.0-rc1, < OTP-27.3.3 | — |
Authoritative record: CVE-2025-32433 at cve.org
Vendors: erlang
Weaknesses: CWE-306
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-32433 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
