CVE-2026-54886

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 17.0 through 29.0.3 Erlang OTP version 28.5.0.3 Erlang OTP version 27.3.4.14

Description An infinite loop exists in the ssh sftpd module of Erlang OTP. An authenticated SFTP user can cause an SFTP channel to become permanently unresponsive by sending SSH MSG CHANNEL EXTENDED DATA with a non-zero type code, an empty pending buffer, and a payload within the SFTP packet size limit. This triggers a tail-recursive loop in the handle data() function, causing the process to stop processing messages and leading to unbounded message queue memory growth and high CPU consumption. The impact is a denial of service on targeted SFTP channels. This effect can be amplified if the max channels setting is set to infinity, allowing a single user to open unlimited channels.

Recommendations Update Erlang OTP to a version newer than 29.0.3, 28.5.0.3, and 27.3.4.14. Set the max channels daemon option to a finite value to limit channels per connection. Set the max sessions daemon option to limit total concurrent SSH connections. Use external process monitoring to identify and terminate ssh sftpd processes exhibiting high reduction counts and growing message queues. Restrict access to the SFTP server port to trusted machines only.