CVE-2026-54886 - Vulnerability Details

- SSH SFTP server denial of service via extended channel data infinite loop

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive.

The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop.

The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit.

The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact.

Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications.

No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth.

This vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4.

This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9.

Published: 2026-07-02

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An authenticated SFTP client can send an SSH_MSG_CHANNEL_EXTENDED_DATA packet with a non‑zero type code and a payload within the allowed size limit, triggering the handle_data/4 function in ssh_sftpd to tail‑recursively call itself with the same arguments. The function never reaches an exit condition, creating an infinite loop that consumes the process’s entire CPU share and allows its message queue to grow without bound. Because no file contents or credentials are leaked, the impact is limited to a non‑responsive SFTP channel and secondary resource exhaustion manifested as increased CPU usage and memory consumption.

Affected Systems

The vulnerability affects Erlang:OTP releases from 17.0 through 29.0.3, 28.5.0.3, and 27.3.4.14, which correspond to the SSH modules 3.0.1 through 6.0.2, 5.5.2.2, and 5.2.11.9 respectively. Any deployment that uses the ssh_sftpd module and permits authenticated SFTP users is vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attack requires a network‑based authenticated SFTP session; there is no privilege escalation or data disclosure. The default OTP configuration sets max_channels to infinity, enabling an attacker to open unlimited channels per connection and amplify the CPU and memory impact.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Erlang

OTP

unaffected

Version	Status	Constraints
`3.0.1`	affected	< *

Erlang

OTP

unaffected

Version	Status	Constraints
`17.0`	affected	< *
`84adefa3318eef8631bf25cd233246a86eea18cd`	affected	< eaf9550b8ad4738b81149d3f617102d980c6dd18

No data.

Vendor Product Confidence Versions

Erlang

Erlang/otp

95%

Version	Status	Scheme	Platform
`[3.0.1,*]`	affected	semver	—
`6.0.2`	unaffected	semver	—
`5.5.2.2`	unaffected	generic	—
`5.2.11.9`	unaffected	generic	—
`17.0`	affected	generic	—
`[84adefa3318eef8631bf25cd233246a86eea18cd,eaf9550b8ad4738b81149d3f617102d980c6dd18)`	affected	code_commit	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[3.0.1,*]`	affected	semver	—
`6.0.2`	unaffected	semver	—
`5.5.2.2`	unaffected	generic	—
`5.2.11.9`	unaffected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`17.0`	affected	generic	—
`[84adefa3318eef8631bf25cd233246a86eea18cd,eaf9550b8ad4738b81149d3f617102d980c6dd18)`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Workaround

* Set the max_channels daemon option to a finite value (e.g., {max_channels, 10}) to limit the number of channels an attacker can open per connection. * Set the max_sessions daemon option to limit total concurrent SSH connections to the daemon. * Use external process monitoring to detect and kill ssh_sftpd processes with abnormally high reduction counts and growing message queues. * Ensure that the SFTP server port is not reachable from untrusted machines.

OpenCVE Recommended Actions

Upgrade Erlang OTP to a release newer than 29.0.3, 28.5.0.3, or 27.3.4.14 to apply the official patch
Set the daemon option {max_channels, N} to a finite value (e.g., 10) to limit the number of channels per connection
Configure the {max_sessions, N} daemon option to restrict total concurrent SSH connections
Use external process monitoring to detect and terminate ssh_sftpd processes with abnormally high reduction counts and growing message queues
Ensure the SFTP port is not reachable from untrusted networks or enforce access control with a firewall

Generated by OpenCVE AI on July 21, 2026 at 11:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0033.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-54886.html
https://github.com/erlang/otp/commit/eaf9550b8ad4738b81149d3f617102d980c6dd18
https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9
https://nvd.nist.gov/vuln/detail/CVE-2026-54886
https://osv.dev/vulnerability/EEF-CVE-2026-54886
https://www.cve.org/CVERecord?id=CVE-2026-54886
https://www.erlang.org/doc/system/versions.html#order-of-versions

History

Fri, 03 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-54886 https://www.cve.org/CVERecord?id=CVE-2026-54886
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 02 Jul 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang/otp Erlang otp
Vendors & Products		Erlang erlang/otp Erlang otp

Thu, 02 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 02 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop. The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit. The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact. Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications. No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth. This vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9.
Title		SSH SFTP server denial of service via extended channel data infinite loop
First Time appeared		Erlang Erlang erlang\/otp
Weaknesses		CWE-400 CWE-835
CPEs		cpe:2.3:a:erlang:erlang\/otp::::::::
Vendors & Products		Erlang Erlang erlang\/otp
References		https://cna.erlef.org/cves/CVE-2026-54886.html https://github.com/erlang/otp/commit/eaf9550b8ad4738b81149d3f617102d980c6dd18 https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9 https://osv.dev/vulnerability/EEF-CVE-2026-54886 https://www.erlang.org/doc/system/versions.html#order-of-versions
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-07-02T16:06:20.502Z

Updated: 2026-07-03T04:29:26.056Z

Reserved: 2026-06-16T10:47:13.914Z

Link: CVE-2026-54886

Vulnrichment

Updated: 2026-07-02T17:27:27.846Z

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-02T16:06:20Z

Links: CVE-2026-54886 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-21T11:15:05Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object