EUVD-2026-36054Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (EEF) · only source for this CVE.
CVSS VectorVendor: EEF
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.
When the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh_options:get_password_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames.
The user_passwords and password options are documented as intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability.
This vulnerability is associated with program files lib/ssh/src/ssh_auth.erl and lib/ssh/src/ssh_options.erl.
This issue affects OTP from OTP 29.0 before 29.0.2 corresponding to ssh from 6.0 before 6.0.1.
AnalysisAI
Username enumeration via timing side-channel in Erlang/OTP SSH daemon (OTP 29.0-29.0.1) allows unauthenticated remote attackers to distinguish valid from invalid usernames in a single probe. When the daemon is configured with the user_passwords or password options, valid usernames trigger a 600,000-iteration PBKDF2-SHA256 computation (~300ms) while invalid usernames return near-instantly (~0ms) through an early-exit path - a gap detectable without repeated attempts. No public exploit has been identified at time of analysis, and exploitation is constrained to non-default, test-oriented configurations.
Technical ContextAI
The root cause is CWE-208 (Observable Timing Discrepancy), a side-channel class where secret-dependent branching leaks information through measurable execution time. In lib/ssh/src/ssh_auth.erl, the function ssh_auth:check_password/3 invokes a 600,000-iteration PBKDF2-SHA256 derivation only for usernames matched in the user_passwords list; unrecognized usernames exit early via ssh_options:get_password_option/2 in lib/ssh/src/ssh_options.erl with no equivalent computation. CPE cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:* covers the Erlang/OTP platform's built-in SSH library. The fix at commit c342092ef4b369bb409d5b71ac8fd83bab74aedf introduces maybe_add_fake_passwd_checker/2 in ssh_options.erl, which injects a dummy PBKDF2 run for the invalid-username path when pwdfun is not configured, normalizing response timing regardless of username validity. The patched hardening documentation also now explicitly warns that custom pwdfun implementations must use constant-time comparisons to avoid reintroducing the same class of oracle.
RemediationAI
Upgrade to Erlang/OTP 29.0.2 (SSH library 6.0.1), which resolves the issue by running a dummy PBKDF2 computation on the invalid-username path, equalizing server response timing. The upstream patch is at commit c342092ef4b369bb409d5b71ac8fd83bab74aedf and the advisory is at https://github.com/erlang/otp/security/advisories/GHSA-3w6p-vwhf-wvp4. For operators who cannot upgrade immediately, replace the user_passwords or password daemon options with pwdfun, which is the documented production alternative and is not affected by this vulnerability. When implementing a pwdfun callback, use constant-time password comparison and avoid early returns based on username validity - the patched hardening guide explicitly warns that a naive pwdfun implementation can reintroduce the same timing oracle. This workaround requires code changes to the SSH daemon configuration and testing of the callback implementation for timing uniformity.
Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by
Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
We need to output a JSON object based on the CVE-2026-59250 data. We must synthesize from multiple sources: description,
Authorization bypass in Erlang OTP's inets HTTP server allows unanauthenticated remote attackers to execute CGI scripts
Denial of service in the Erlang/OTP ssl application (OTP 22.2 through 29.0.3, and the 28.5.x/27.3.x maintenance branches
Erlang OTP public_key module (versions 1.16 through 1.20.3 and 1.17.1.2) fails to cryptographically verify OCSP responde
Authentication bypass in Erlang/OTP's TLS distribution module (inet_tls_dist) lets any attacker holding a TLS certificat
Credential leakage in Erlang/OTP's inets httpc client (versions 17.0 through 29.0.2, 28.5.0.2, and 27.3.4.13) allows att
A critical HTTP Request Smuggling vulnerability exists in Erlang OTP's inets httpd module that allows attackers to desyn
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today