Description
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler.

The "session" clause of ssh_connection:handle_msg/4 checks only minimal_remote_max_packet_size before calling setup_session/5, which unconditionally builds a #channel{} record and stores it in the ETS channel cache. The max_channels daemon option is consulted only by ssh_channel_sup:max_num_channels_not_exceeded/2, which counts supervisor children, so a channel that never gets a shell, exec, or subsystem handler is invisible to the limit and setting the option to a finite value does not mitigate the attack. RFC 4254 section 5.1 permits many session channels per connection, and each record costs only a few hundred bytes, so a single authenticated connection can accumulate channels until the node runs out of memory and the emulator terminates, affecting every application on it. No file contents, credentials, or write access are obtainable.

This issue affects OTP from OTP 18.1.2 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to ssh from 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6. Whether OTP before OTP 18.1.2, corresponding to ssh before 4.1.1, is affected is unknown.
Published: 2026-09-22
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

An authenticated SSH client can repeatedly open session channels that never receive a handler. Each channel is stored in the ETS cache, consuming a few hundred bytes of memory per channel. The daemon option that limits session creation is bypassed for these idle channels, so a single attacker can exhaust node memory, causing the Erlang VM to crash and bringing down all applications. The vulnerability does not grant access to files or credentials; its impact is a denial of service.

Affected Systems

The vulnerability affects Erlang/OTP releases 18.1.2 through but not including 27.3.4.18, as well as 28.5.0.7 and 29.1.1, corresponding to ssh versions 4.1.1 through but not including 5.2.11.13, 5.5.2.6, and 6.0.6. Versions before 18.1.2 (ssh before 4.1.1) are currently unknown to be affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a high impact if exploited, but exploitation requires the attacker to first authenticate to the SSH daemon, so the likelihood of successful use is limited to environments with weak or compromised credentials. The EPSS score is not available, and the vulnerability does not appear in the CISA KEV catalog, suggesting that active exploitation is not widely documented. Nonetheless, because any single authenticated connection can exhaust memory, the attack is potent and should be mitigated promptly.

Generated by OpenCVE AI on September 22, 2026 at 12:52 UTC.

Remediation

Vendor Workaround

No option bounds the number of idle session channels, so the following reduce exposure without eliminating the issue. * Restrict network access to the SSH daemon to trusted clients. Exploitation requires a successfully authenticated session, so limiting who can authenticate is the most effective control available. * Set the max_sessions daemon option to a finite value to bound the number of concurrent connections. This limits how many connections can mount the attack in parallel, though a single connection still suffices to exhaust memory. * Apply operating-system or firewall connection-rate and connection-count limits per source address. * Monitor node memory externally and restart the emulator when it exceeds a threshold. Setting max_channels is not a workaround: idle session channels bypass that check entirely.

OpenCVE Recommended Actions

  • Upgrade Erlang/OTP to a release newer than 27.3.4.18, 28.5.0.7, or 29.1.1 that contains the fix for the unbounded idle session channel allocation
  • Restrict SSH access to trusted hosts or IP ranges so that only authorized clients can authenticate
  • Configure the max_sessions daemon option with a reasonable limit; although it does not control idle channels directly, it reduces the number of parallel connections that can be opened
  • Apply operating‑system or firewall limits on the rate and count of connections per source address
  • Monitor node memory externally and restart the emulator when the threshold is exceeded

Generated by OpenCVE AI on September 22, 2026 at 12:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Erlang otp
Vendors & Products Erlang erlang/otp
Erlang otp

Tue, 22 Sep 2026 11:00:00 +0000

Type Values Removed Values Added
Description Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of ssh_connection:handle_msg/4 checks only minimal_remote_max_packet_size before calling setup_session/5, which unconditionally builds a #channel{} record and stores it in the ETS channel cache. The max_channels daemon option is consulted only by ssh_channel_sup:max_num_channels_not_exceeded/2, which counts supervisor children, so a channel that never gets a shell, exec, or subsystem handler is invisible to the limit and setting the option to a finite value does not mitigate the attack. RFC 4254 section 5.1 permits many session channels per connection, and each record costs only a few hundred bytes, so a single authenticated connection can accumulate channels until the node runs out of memory and the emulator terminates, affecting every application on it. No file contents, credentials, or write access are obtainable. This issue affects OTP from OTP 17.0 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to ssh from 3.0.1 before 5.2.11.13, 5.5.2.6, and 6.0.6. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown. Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of ssh_connection:handle_msg/4 checks only minimal_remote_max_packet_size before calling setup_session/5, which unconditionally builds a #channel{} record and stores it in the ETS channel cache. The max_channels daemon option is consulted only by ssh_channel_sup:max_num_channels_not_exceeded/2, which counts supervisor children, so a channel that never gets a shell, exec, or subsystem handler is invisible to the limit and setting the option to a finite value does not mitigate the attack. RFC 4254 section 5.1 permits many session channels per connection, and each record costs only a few hundred bytes, so a single authenticated connection can accumulate channels until the node runs out of memory and the emulator terminates, affecting every application on it. No file contents, credentials, or write access are obtainable. This issue affects OTP from OTP 18.1.2 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to ssh from 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6. Whether OTP before OTP 18.1.2, corresponding to ssh before 4.1.1, is affected is unknown.
References

Tue, 22 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Description Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of ssh_connection:handle_msg/4 checks only minimal_remote_max_packet_size before calling setup_session/5, which unconditionally builds a #channel{} record and stores it in the ETS channel cache. The max_channels daemon option is consulted only by ssh_channel_sup:max_num_channels_not_exceeded/2, which counts supervisor children, so a channel that never gets a shell, exec, or subsystem handler is invisible to the limit and setting the option to a finite value does not mitigate the attack. RFC 4254 section 5.1 permits many session channels per connection, and each record costs only a few hundred bytes, so a single authenticated connection can accumulate channels until the node runs out of memory and the emulator terminates, affecting every application on it. No file contents, credentials, or write access are obtainable. This issue affects OTP from OTP 17.0 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to ssh from 3.0.1 before 5.2.11.13, 5.5.2.6, and 6.0.6. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.
Title SSH daemon allocates unbounded idle session channels, bypassing max_channels
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-770
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-22T10:44:31.598Z

Reserved: 2026-08-17T13:30:02.155Z

Link: CVE-2026-68956

cve-icon Vulnrichment

Updated: 2026-09-22T10:15:32.927Z

cve-icon NVD

Status : Received

Published: 2026-09-22T09:17:05.313

Modified: 2026-09-22T11:17:25.067

Link: CVE-2026-68956

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T13:00:14Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling