🔗 What the Critical Erlang SSH Vulnerability Means for Elixir Developers

CVE-2025-32433, an Unauthenticated Remote Code Execution in Erlang/OTP SSH was announced yesterday. From the description:

A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials.

All users running the Erlang/OTP SSH server are impacted by this vulnerability, regardless of the underlying Erlang/OTP version. If your application provides SSH access using the Erlang/OTP SSH library, assume you are affected.

Affected versions    Patched versions
<= OTP-27.3.2        OTP-27.3.3
<= OTP-26.2.5.10     OTP-26.2.5.11
<= OTP-25.3.2.19     OTP-25.3.2.20

On the GitHub security page for Erlang/OTP, the severity is 10/10 critical, meaning if you are running an application that exposes Erlang’s SSH daemon to the public internet, anyone who knows how to exploit this vulnerability can hack into your server. An exploit has been published.