Answer in brief
CVE-2026-48859 records a Medium severity (CVSS 5.3) vulnerability in SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration. The current sources do not mark it as known exploited. The current feed maps Erlang/OTP (generic), Erlang/OTP (generic), Erlang/OTP (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Erlang/OTP (generic), Erlang/OTP (generic), Erlang/OTP (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Erlang/OTPgeneric | >=29.0 <29.0.2 | 29.0.2 |
| Erlang/OTPgeneric | >=6.0 <6.0.1 | 6.0.1 |
| Erlang/OTPgeneric | >=032d1bc9491a3975c68faf9bc7776115d6ae3005 <c342092ef4b369bb409d5b71ac8fd83bab74aedf | c342092ef4b369bb409d5b71ac8fd83bab74aedf |
Published upstream
Jun 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 3, 2026
Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication. When the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh_options:get_password_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames. The user_passwords and password options are documented as intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability. This vulnerability is associated with program files lib/ssh/src/ssh_auth.erl and lib/ssh/src/ssh_options.erl. This issue affects OTP from OTP 29.0 before OTP 29.0.2, corresponding to ssh from 6.0 before 6.0.1.
Quoted source text, attributed separately from HOL analysis.