CVE-2026-54886
SSH SFTP server denial of service via extended channel data infinite loop
Description
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop. The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit. The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact. Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications. No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth. This vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4. This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.
INFO
Published Date :
July 2, 2026, 5:17 p.m.
Last Modified :
Oct. 25, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Affected Products
The following products are affected by CVE-2026-54886
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update Erlang/OTP to a version with the fix.
- Apply vendor patches for the ssh_sftpd module.
- Limit the number of SFTP channels per connection.
- Monitor SFTP channel activity for anomalies.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-54886.
| URL | Resource |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-54886.html | Mitigation Vendor Advisory |
| https://github.com/erlang/otp/commit/eaf9550b8ad4738b81149d3f617102d980c6dd18 | Patch |
| https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9 | Mitigation Vendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-54886 | Mitigation Third Party Advisory |
| https://www.erlang.org/doc/system/versions.html#order-of-versions | Release Notes |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-54886 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-54886
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-54886 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-54886 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: OTP de Erlang, Description: Una vulnerabilidad de bucle con condición de salida inalcanzable (’Bucle Infinito’) en Erlang OTP ssh (módulo ssh_sftpd) permite a un usuario SFTP autenticado dejar un canal SFTP permanentemente sin respuesta. La función handle_data/4 en ssh_sftpd contiene una cláusula comodín que acepta datos de canal de cualquier tipo. Cuando los datos de canal con un código de tipo no cero (SSH_MSG_CHANNEL_EXTENDED_DATA) llegan con un búfer pendiente vacío y una carga útil igual o inferior al límite de tamaño del paquete SFTP, la cláusula se llama a sí misma de forma recursiva con argumentos idénticos, creando un bucle infinito. El protocolo SFTP opera exclusivamente con datos de canal normales (tipo 0). Los datos extendidos (tipo no cero) no tienen sentido para SFTP y nunca son enviados por clientes conformes. Sin embargo, el protocolo SSH permite a cualquier participante del canal enviar datos extendidos en un canal abierto, por lo que un cliente SFTP autenticado puede activar el bucle enviando SSH_MSG_CHANNEL_EXTENDED_DATA con cualquier data_type_code y cualquier carga útil no vacía igual o inferior al límite de tamaño. El proceso ssh_sftpd objetivo entra en un bucle recursivo de cola infinito. Nunca procesa otro mensaje, su cola de mensajes crece sin límite y solo puede detenerse eliminando el proceso. La preferencia del planificador basada en reducción de BEAM sigue funcionando, por lo que otros procesos en el nodo no se quedan sin recursos, pero cada proceso de canal atascado consume continuamente su parte completa de tiempo de CPU y acumula memoria de cola de mensajes ilimitada. Abrir muchos canales amplifica el impacto en la CPU y la memoria. Las configuraciones de Erlang/OTP SSH que utilizan la configuración predeterminada de max_channels (infinito) permiten a un usuario autenticado abrir canales ilimitados por conexión, amplificando el ataque sin requerir múltiples conexiones TCP o autenticaciones. No se pueden obtener contenidos de archivos, credenciales o acceso de escritura a través de este problema. El impacto se limita a la denegación de servicio en los canales SFTP objetivo, con degradación secundaria de la CPU y crecimiento de la memoria. Esta vulnerabilidad está asociada con el archivo de programa lib/ssh/src/ssh_sftpd.erl y la rutina de programa ssh_sftpd:handle_data/4. Este problema afecta a OTP desde OTP 17.0 hasta OTP 29.0.3, 28.5.0.3 y 27.3.4.14 correspondiente a ssh desde 3.0.1 hasta 6.0.2, 5.5.2.2 y 5.2.11.9. -
CVE Modified by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jul. 24, 2026
Action Type Old Value New Value Changed Description Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop. The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit. The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact. Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications. No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth. This vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9. Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop. The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit. The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact. Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications. No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth. This vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4. This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9. -
Initial Analysis by [email protected]
Jul. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Added CPE Configuration OR *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 17.0 up to (excluding) 27.3.4.14 *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 28.0 up to (excluding) 28.5.0.3 *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 29.0 up to (excluding) 29.0.3 *cpe:2.3:a:erlang:erlang/ssh:*:*:*:*:*:*:*:* versions from (including) 3.0.1 up to (excluding) 5.2.11.9 *cpe:2.3:a:erlang:erlang/ssh:*:*:*:*:*:*:*:* versions from (including) 5.3 up to (excluding) 5.5.2.2 *cpe:2.3:a:erlang:erlang/ssh:*:*:*:*:*:*:*:* versions from (including) 6.0 up to (excluding) 6.0.2 Added Reference Type EEF: https://cna.erlef.org/cves/CVE-2026-54886.html Types: Mitigation, Vendor Advisory Added Reference Type EEF: https://github.com/erlang/otp/commit/eaf9550b8ad4738b81149d3f617102d980c6dd18 Types: Patch Added Reference Type EEF: https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9 Types: Mitigation, Vendor Advisory Added Reference Type EEF: https://osv.dev/vulnerability/EEF-CVE-2026-54886 Types: Mitigation, Third Party Advisory Added Reference Type EEF: https://www.erlang.org/doc/system/versions.html#order-of-versions Types: Release Notes -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 02, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-54886', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-02T17:27:25.414155Z'} -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jul. 02, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['ssh_sftpd'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '6.0.2', 'status': 'unaffected'}, {'at': '5.5.2.2', 'status': 'unaffected'}, {'at': '5.2.11.9', 'status': 'unaffected'}], 'version': '3.0.1', 'lessThan': '*', 'versionType': 'otp'}], 'packageURL': 'pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git', 'packageName': 'ssh', 'programFiles': ['src/ssh_sftpd.erl'], 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'ssh_sftpd:handle_data/4'}]}, {'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['ssh_sftpd'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '29.0.3', 'status': 'unaffected'}, {'at': '28.5.0.3', 'status': 'unaffected'}, {'at': '27.3.4.14', 'status': 'unaffected'}], 'version': '17.0', 'lessThan': '*', 'versionType': 'otp'}, {'status': 'affected', 'version': '84adefa3318eef8631bf25cd233246a86eea18cd', 'lessThan': 'eaf9550b8ad4738b81149d3f617102d980c6dd18', 'versionType': 'git'}], 'packageURL': 'pkg:github/erlang/otp', 'packageName': 'erlang/otp', 'programFiles': ['lib/ssh/src/ssh_sftpd.erl'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'ssh_sftpd:handle_data/4'}]}] Added Description Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop. The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit. The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact. Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications. No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth. This vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-400 Added CWE CWE-835 Added Reference https://cna.erlef.org/cves/CVE-2026-54886.html Added Reference https://github.com/erlang/otp/commit/eaf9550b8ad4738b81149d3f617102d980c6dd18 Added Reference https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9 Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-54886 Added Reference https://www.erlang.org/doc/system/versions.html#order-of-versions