cve-2026-48858

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48858.json"
      }
    ],
    "title": "erlang: erlang-inets: erlang-ftp: Erlang/OTP ftp: Server-Side Request Forgery (SSRF) via unvalidated PASV response IP address",
    "tracking": {
      "current_release_date": "2026-06-27T16:29:40+00:00",
      "generator": {
        "date": "2026-06-27T16:29:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.2.6"
        }
      },
      "id": "CVE-2026-48858",
      "initial_release_date": "2026-06-10T14:35:45.466000+00:00",
      "revision_history": [
        {
          "date": "2026-06-10T14:35:45.466000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-17T05:15:22+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-06-27T16:29:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 16.2",
                "product": {
                  "name": "Red Hat OpenStack Platform 16.2",
                  "product_id": "red_hat_openstack_platform_16.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:16.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform 16.2"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 17.1",
                "product": {
                  "name": "Red Hat OpenStack Platform 17.1",
                  "product_id": "red_hat_openstack_platform_17.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:17.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform 17.1"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 18.0",
                "product": {
                  "name": "Red Hat OpenStack Platform 18.0",
                  "product_id": "red_hat_openstack_platform_18.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:18.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform 18.0"
          },
          {
            "category": "product_version",
            "name": "erlang-xmerl",
            "product": {
              "name": "erlang-xmerl",
              "product_id": "erlang-xmerl",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-xmerl"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-snmp",
            "product": {
              "name": "erlang-snmp",
              "product_id": "erlang-snmp",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-snmp"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-runtime_tools",
            "product": {
              "name": "erlang-runtime_tools",
              "product_id": "erlang-runtime_tools",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-runtime_tools"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-hipe",
            "product": {
              "name": "erlang-hipe",
              "product_id": "erlang-hipe",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-hipe"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-os_mon",
            "product": {
              "name": "erlang-os_mon",
              "product_id": "erlang-os_mon",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-os_mon"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-ssl",
            "product": {
              "name": "erlang-ssl",
              "product_id": "erlang-ssl",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-ssl"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-tools",
            "product": {
              "name": "erlang-tools",
              "product_id": "erlang-tools",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-tools"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang.src",
            "product": {
              "name": "erlang.src",
              "product_id": "erlang.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-crypto",
            "product": {
              "name": "erlang-crypto",
              "product_id": "erlang-crypto",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-crypto"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-eldap",
            "product": {
              "name": "erlang-eldap",
              "product_id": "erlang-eldap",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-eldap"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-kernel",
            "product": {
              "name": "erlang-kernel",
              "product_id": "erlang-kernel",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-kernel"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-parsetools",
            "product": {
              "name": "erlang-parsetools",
              "product_id": "erlang-parsetools",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-parsetools"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-compiler",
            "product": {
              "name": "erlang-compiler",
              "product_id": "erlang-compiler",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-compiler"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-erts",
            "product": {
              "name": "erlang-erts",
              "product_id": "erlang-erts",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-erts"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-public_key",
            "product": {
              "name": "erlang-public_key",
              "product_id": "erlang-public_key",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-public_key"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-stdlib",
            "product": {
              "name": "erlang-stdlib",
              "product_id": "erlang-stdlib",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-stdlib"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-inets",
            "product": {
              "name": "erlang-inets",
              "product_id": "erlang-inets",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-inets"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-asn1",
            "product": {
              "name": "erlang-asn1",
              "product_id": "erlang-asn1",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-asn1"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-syntax_tools",
            "product": {
              "name": "erlang-syntax_tools",
              "product_id": "erlang-syntax_tools",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-syntax_tools"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-sasl",
            "product": {
              "name": "erlang-sasl",
              "product_id": "erlang-sasl",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-sasl"
              }
            }
          },
          {
            "category": "product_version",
            "name": "erlang-mnesia",
            "product": {
              "name": "erlang-mnesia",
              "product_id": "erlang-mnesia",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/erlang-mnesia"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-asn1 as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-asn1"
        },
        "product_reference": "erlang-asn1",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-compiler as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-compiler"
        },
        "product_reference": "erlang-compiler",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-crypto as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-crypto"
        },
        "product_reference": "erlang-crypto",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-eldap as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-eldap"
        },
        "product_reference": "erlang-eldap",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-erts as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-erts"
        },
        "product_reference": "erlang-erts",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-hipe as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-hipe"
        },
        "product_reference": "erlang-hipe",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-inets as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-inets"
        },
        "product_reference": "erlang-inets",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-kernel as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-kernel"
        },
        "product_reference": "erlang-kernel",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-mnesia as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-mnesia"
        },
        "product_reference": "erlang-mnesia",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-os_mon as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-os_mon"
        },
        "product_reference": "erlang-os_mon",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-parsetools as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-parsetools"
        },
        "product_reference": "erlang-parsetools",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-public_key as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-public_key"
        },
        "product_reference": "erlang-public_key",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-runtime_tools as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-runtime_tools"
        },
        "product_reference": "erlang-runtime_tools",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-sasl as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-sasl"
        },
        "product_reference": "erlang-sasl",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-snmp as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-snmp"
        },
        "product_reference": "erlang-snmp",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-ssl as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-ssl"
        },
        "product_reference": "erlang-ssl",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-stdlib as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-stdlib"
        },
        "product_reference": "erlang-stdlib",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-syntax_tools as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-syntax_tools"
        },
        "product_reference": "erlang-syntax_tools",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-tools as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-tools"
        },
        "product_reference": "erlang-tools",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-xmerl as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang-xmerl"
        },
        "product_reference": "erlang-xmerl",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang.src as a component of Red Hat OpenStack Platform 16.2",
          "product_id": "red_hat_openstack_platform_16.2:erlang.src"
        },
        "product_reference": "erlang.src",
        "relates_to_product_reference": "red_hat_openstack_platform_16.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-asn1 as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-asn1"
        },
        "product_reference": "erlang-asn1",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-compiler as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-compiler"
        },
        "product_reference": "erlang-compiler",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-crypto as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-crypto"
        },
        "product_reference": "erlang-crypto",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-eldap as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-eldap"
        },
        "product_reference": "erlang-eldap",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-erts as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-erts"
        },
        "product_reference": "erlang-erts",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-inets as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-inets"
        },
        "product_reference": "erlang-inets",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-kernel as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-kernel"
        },
        "product_reference": "erlang-kernel",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-mnesia as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-mnesia"
        },
        "product_reference": "erlang-mnesia",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-os_mon as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-os_mon"
        },
        "product_reference": "erlang-os_mon",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-parsetools as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-parsetools"
        },
        "product_reference": "erlang-parsetools",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-public_key as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-public_key"
        },
        "product_reference": "erlang-public_key",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-runtime_tools as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-runtime_tools"
        },
        "product_reference": "erlang-runtime_tools",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-sasl as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-sasl"
        },
        "product_reference": "erlang-sasl",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-snmp as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-snmp"
        },
        "product_reference": "erlang-snmp",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-ssl as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-ssl"
        },
        "product_reference": "erlang-ssl",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-stdlib as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-stdlib"
        },
        "product_reference": "erlang-stdlib",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-syntax_tools as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-syntax_tools"
        },
        "product_reference": "erlang-syntax_tools",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-tools as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-tools"
        },
        "product_reference": "erlang-tools",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang-xmerl as a component of Red Hat OpenStack Platform 17.1",
          "product_id": "red_hat_openstack_platform_17.1:erlang-xmerl"
        },
        "product_reference": "erlang-xmerl",
        "relates_to_product_reference": "red_hat_openstack_platform_17.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "erlang.src as a component of Red Hat OpenStack Platform 18.0",
          "product_id": "red_hat_openstack_platform_18.0:erlang.src"
        },
        "product_reference": "erlang.src",
        "relates_to_product_reference": "red_hat_openstack_platform_18.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-48858",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-06-10T16:00:59.601093+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487593"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Erlang/OTP's FTP (File Transfer Protocol) client, specifically within the ftp_internal module. A remote attacker, by operating a malicious or compromised FTP server, could exploit an unvalidated IP address in the server's passive mode (PASV) response. This vulnerability, known as Server-Side Request Forgery (SSRF), allows the attacker to redirect the client's data connection to an arbitrary internal host and port. This can lead to information disclosure from internal systems or the sending of sensitive data to unintended third-party hosts, enabling FTP bounce attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "erlang: erlang-inets: erlang-ftp: Erlang/OTP ftp: Server-Side Request Forgery (SSRF) via unvalidated PASV response IP address",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate severity flaw in the Erlang/OTP FTP client allows a remote attacker to perform Server-Side Request Forgery (SSRF) by redirecting data connections to arbitrary internal hosts. This occurs when the client connects to a malicious or compromised FTP server that provides an unvalidated IP address in its passive mode response, potentially leading to information disclosure or data exfiltration from internal systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "under_investigation": [
          "red_hat_openstack_platform_16.2:erlang-asn1",
          "red_hat_openstack_platform_16.2:erlang-compiler",
          "red_hat_openstack_platform_16.2:erlang-crypto",
          "red_hat_openstack_platform_16.2:erlang-eldap",
          "red_hat_openstack_platform_16.2:erlang-erts",
          "red_hat_openstack_platform_16.2:erlang-hipe",
          "red_hat_openstack_platform_16.2:erlang-inets",
          "red_hat_openstack_platform_16.2:erlang-kernel",
          "red_hat_openstack_platform_16.2:erlang-mnesia",
          "red_hat_openstack_platform_16.2:erlang-os_mon",
          "red_hat_openstack_platform_16.2:erlang-parsetools",
          "red_hat_openstack_platform_16.2:erlang-public_key",
          "red_hat_openstack_platform_16.2:erlang-runtime_tools",
          "red_hat_openstack_platform_16.2:erlang-sasl",
          "red_hat_openstack_platform_16.2:erlang-snmp",
          "red_hat_openstack_platform_16.2:erlang-ssl",
          "red_hat_openstack_platform_16.2:erlang-stdlib",
          "red_hat_openstack_platform_16.2:erlang-syntax_tools",
          "red_hat_openstack_platform_16.2:erlang-tools",
          "red_hat_openstack_platform_16.2:erlang-xmerl",
          "red_hat_openstack_platform_16.2:erlang.src",
          "red_hat_openstack_platform_17.1:erlang-asn1",
          "red_hat_openstack_platform_17.1:erlang-compiler",
          "red_hat_openstack_platform_17.1:erlang-crypto",
          "red_hat_openstack_platform_17.1:erlang-eldap",
          "red_hat_openstack_platform_17.1:erlang-erts",
          "red_hat_openstack_platform_17.1:erlang-inets",
          "red_hat_openstack_platform_17.1:erlang-kernel",
          "red_hat_openstack_platform_17.1:erlang-mnesia",
          "red_hat_openstack_platform_17.1:erlang-os_mon",
          "red_hat_openstack_platform_17.1:erlang-parsetools",
          "red_hat_openstack_platform_17.1:erlang-public_key",
          "red_hat_openstack_platform_17.1:erlang-runtime_tools",
          "red_hat_openstack_platform_17.1:erlang-sasl",
          "red_hat_openstack_platform_17.1:erlang-snmp",
          "red_hat_openstack_platform_17.1:erlang-ssl",
          "red_hat_openstack_platform_17.1:erlang-stdlib",
          "red_hat_openstack_platform_17.1:erlang-syntax_tools",
          "red_hat_openstack_platform_17.1:erlang-tools",
          "red_hat_openstack_platform_17.1:erlang-xmerl",
          "red_hat_openstack_platform_18.0:erlang.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487593",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487593"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48858"
        },
        {
          "category": "external",
          "summary": "https://cna.erlef.org/cves/CVE-2026-48858.html",
          "url": "https://cna.erlef.org/cves/CVE-2026-48858.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/erlang/otp/commit/2691a806231ffd0490a8a9e20500dec0c7e73727",
          "url": "https://github.com/erlang/otp/commit/2691a806231ffd0490a8a9e20500dec0c7e73727"
        },
        {
          "category": "external",
          "summary": "https://github.com/erlang/otp/commit/521bcfa24407ee8cb5614823cf905c37ea3aa605",
          "url": "https://github.com/erlang/otp/commit/521bcfa24407ee8cb5614823cf905c37ea3aa605"
        },
        {
          "category": "external",
          "summary": "https://github.com/erlang/otp/security/advisories/GHSA-24cv-hwgr-37fq",
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-24cv-hwgr-37fq"
        },
        {
          "category": "external",
          "summary": "https://osv.dev/vulnerability/EEF-CVE-2026-48858",
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48858"
        },
        {
          "category": "external",
          "summary": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        }
      ],
      "release_date": "2026-06-10T14:35:45.466000+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "red_hat_openstack_platform_16.2:erlang-asn1",
            "red_hat_openstack_platform_16.2:erlang-compiler",
            "red_hat_openstack_platform_16.2:erlang-crypto",
            "red_hat_openstack_platform_16.2:erlang-eldap",
            "red_hat_openstack_platform_16.2:erlang-erts",
            "red_hat_openstack_platform_16.2:erlang-hipe",
            "red_hat_openstack_platform_16.2:erlang-inets",
            "red_hat_openstack_platform_16.2:erlang-kernel",
            "red_hat_openstack_platform_16.2:erlang-mnesia",
            "red_hat_openstack_platform_16.2:erlang-os_mon",
            "red_hat_openstack_platform_16.2:erlang-parsetools",
            "red_hat_openstack_platform_16.2:erlang-public_key",
            "red_hat_openstack_platform_16.2:erlang-runtime_tools",
            "red_hat_openstack_platform_16.2:erlang-sasl",
            "red_hat_openstack_platform_16.2:erlang-snmp",
            "red_hat_openstack_platform_16.2:erlang-ssl",
            "red_hat_openstack_platform_16.2:erlang-stdlib",
            "red_hat_openstack_platform_16.2:erlang-syntax_tools",
            "red_hat_openstack_platform_16.2:erlang-tools",
            "red_hat_openstack_platform_16.2:erlang-xmerl",
            "red_hat_openstack_platform_16.2:erlang.src",
            "red_hat_openstack_platform_17.1:erlang-asn1",
            "red_hat_openstack_platform_17.1:erlang-compiler",
            "red_hat_openstack_platform_17.1:erlang-crypto",
            "red_hat_openstack_platform_17.1:erlang-eldap",
            "red_hat_openstack_platform_17.1:erlang-erts",
            "red_hat_openstack_platform_17.1:erlang-inets",
            "red_hat_openstack_platform_17.1:erlang-kernel",
            "red_hat_openstack_platform_17.1:erlang-mnesia",
            "red_hat_openstack_platform_17.1:erlang-os_mon",
            "red_hat_openstack_platform_17.1:erlang-parsetools",
            "red_hat_openstack_platform_17.1:erlang-public_key",
            "red_hat_openstack_platform_17.1:erlang-runtime_tools",
            "red_hat_openstack_platform_17.1:erlang-sasl",
            "red_hat_openstack_platform_17.1:erlang-snmp",
            "red_hat_openstack_platform_17.1:erlang-ssl",
            "red_hat_openstack_platform_17.1:erlang-stdlib",
            "red_hat_openstack_platform_17.1:erlang-syntax_tools",
            "red_hat_openstack_platform_17.1:erlang-tools",
            "red_hat_openstack_platform_17.1:erlang-xmerl",
            "red_hat_openstack_platform_18.0:erlang.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "red_hat_openstack_platform_16.2:erlang-asn1",
            "red_hat_openstack_platform_16.2:erlang-compiler",
            "red_hat_openstack_platform_16.2:erlang-crypto",
            "red_hat_openstack_platform_16.2:erlang-eldap",
            "red_hat_openstack_platform_16.2:erlang-erts",
            "red_hat_openstack_platform_16.2:erlang-hipe",
            "red_hat_openstack_platform_16.2:erlang-inets",
            "red_hat_openstack_platform_16.2:erlang-kernel",
            "red_hat_openstack_platform_16.2:erlang-mnesia",
            "red_hat_openstack_platform_16.2:erlang-os_mon",
            "red_hat_openstack_platform_16.2:erlang-parsetools",
            "red_hat_openstack_platform_16.2:erlang-public_key",
            "red_hat_openstack_platform_16.2:erlang-runtime_tools",
            "red_hat_openstack_platform_16.2:erlang-sasl",
            "red_hat_openstack_platform_16.2:erlang-snmp",
            "red_hat_openstack_platform_16.2:erlang-ssl",
            "red_hat_openstack_platform_16.2:erlang-stdlib",
            "red_hat_openstack_platform_16.2:erlang-syntax_tools",
            "red_hat_openstack_platform_16.2:erlang-tools",
            "red_hat_openstack_platform_16.2:erlang-xmerl",
            "red_hat_openstack_platform_16.2:erlang.src",
            "red_hat_openstack_platform_17.1:erlang-asn1",
            "red_hat_openstack_platform_17.1:erlang-compiler",
            "red_hat_openstack_platform_17.1:erlang-crypto",
            "red_hat_openstack_platform_17.1:erlang-eldap",
            "red_hat_openstack_platform_17.1:erlang-erts",
            "red_hat_openstack_platform_17.1:erlang-inets",
            "red_hat_openstack_platform_17.1:erlang-kernel",
            "red_hat_openstack_platform_17.1:erlang-mnesia",
            "red_hat_openstack_platform_17.1:erlang-os_mon",
            "red_hat_openstack_platform_17.1:erlang-parsetools",
            "red_hat_openstack_platform_17.1:erlang-public_key",
            "red_hat_openstack_platform_17.1:erlang-runtime_tools",
            "red_hat_openstack_platform_17.1:erlang-sasl",
            "red_hat_openstack_platform_17.1:erlang-snmp",
            "red_hat_openstack_platform_17.1:erlang-ssl",
            "red_hat_openstack_platform_17.1:erlang-stdlib",
            "red_hat_openstack_platform_17.1:erlang-syntax_tools",
            "red_hat_openstack_platform_17.1:erlang-tools",
            "red_hat_openstack_platform_17.1:erlang-xmerl",
            "red_hat_openstack_platform_18.0:erlang.src"
          ]
        }
      ],
      "title": "erlang: erlang-inets: erlang-ftp: Erlang/OTP ftp: Server-Side Request Forgery (SSRF) via unvalidated PASV response IP address"
    }
  ]
}