Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT. https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
CVE-2025-48041 (SSH/SFTP file handle exhaustion vulnerability) is fixed in Erlang/OTP 26.2.5.15. The EPEL 9 erlang package will not be updated to track upstream patch releases. Users are encouraged to use the CentOS Messaging SIG, which provides erlang-26.2.5.16 for EL9 (CentOS Stream 9, RHEL 9, AlmaLinux 9, Rocky Linux 9, and other EL9 derivatives), which includes the fix for this CVE: dnf install centos-release-messaging