CVE-2026-54886: Erlang/OTP SSH SFTP Infinite Loop Denial of Service

Technical summary

The ssh_sftpd module's handle_data/4 function contains a catch-all clause that processes channel data irrespective of type. When SSH_MSG_CHANNEL_EXTENDED_DATA (type ≠ 0) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the function tail-recursively invokes itself with unchanged arguments. This creates an infinite loop because the condition that would normally unwind the recursion is never met. The loop consumes CPU time through BEAM's scheduler (other processes are not starved) and accumulates unbounded messages in the stuck channel's queue. Since standard SFTP clients never send extended data, this issue manifests only when an authenticated attacker deliberately constructs malicious SSH messages. The default OTP configuration allows unlimited channels per connection, enabling an attacker to amplify impact by spawning many looped channels without additional authentication steps.

Business impact

Organizations deploying Erlang/OTP SFTP servers face availability risk from low-effort denial of service. An attacker with valid SFTP credentials—whether obtained legitimately or through compromise—can render the SFTP service unresponsive by filling channels with stuck processes. This impacts file transfer workflows and forces manual intervention (process restart) to restore service. The attack requires only network access and valid authentication, making it a realistic threat in environments with shared SFTP access or compromised user accounts. However, limited to denial of service, this vulnerability does not enable data exfiltration or system compromise. Operational impact scales with attack intensity; a single looped channel degrades performance incrementally, but dozens of channels can render the service unusable.

Affected systems

Erlang/OTP versions 17.0 through OTP 29.0.2 are affected, with specific vulnerable versions identified: OTP before 29.0.3, OTP 28.5.0.3, and OTP 27.3.4.14. This translates to ssh module versions 3.0.1 before 6.0.2, 5.5.2.2, and 5.2.11.9. Any SFTP server built on Erlang/OTP using the default ssh_sftpd handler without custom patches is vulnerable. Systems on older stable branches (e.g., OTP 26, 25, or earlier) should verify their exact version; the advisory does not explicitly enumerate all legacy versions, so consultation with Erlang/OTP release notes is recommended for releases earlier than 27.3.4.14.

Exploitability

Exploitability is moderate. The attack requires prior authentication—an attacker must possess valid SFTP credentials—making it a post-authentication denial of service. However, once authenticated, triggering the flaw is trivial: sending a single SSH extended-data message with a non-conforming type code. No complex timing, race conditions, or system-specific tuning is necessary. Tools or custom scripts to generate the required SSH message are straightforward to write. The unlimited default channel limit means an attacker can open dozens of channels with a single SSH connection, amplifying impact without requiring multiple authentications. Exploit code is not widespread (CVE is recent), but the simplicity of the attack means weaponization is a realistic near-term risk.

Remediation

Upgrade Erlang/OTP to the patched versions: OTP 29.0.3 or later, OTP 28.5.0.3 or later, or OTP 27.3.4.14 or later. The corresponding ssh module versions are 6.0.2, 5.5.2.2, and 5.2.11.9 respectively. If immediate upgrade is infeasible, apply the following interim controls: (1) Restrict SFTP channel count per connection via the max_channels SSH option to a low, operationally necessary value (e.g., 5–10), limiting the number of channels an attacker can simultaneously loop; (2) Implement firewall or network segmentation to restrict SFTP access to trusted IP ranges; (3) Monitor SFTP process CPU and message queue depth to detect attack signatures (e.g., many channels with stalled message handlers and high CPU consumption); (4) Consider disabling SFTP service on non-essential systems or restricting user credentials. Verify patch applicability against your Erlang/OTP branch and test in a staging environment before production deployment.

Patch guidance

Consult the Erlang/OTP advisory for your release branch. OTP releases follow strict versioning; verify that your current version falls within the vulnerable range (e.g., OTP 28.0–28.5.0.2, OTP 27.0–27.3.4.13) before patching. If your deployment uses a custom build or a vendor-supplied Erlang/OTP, contact your vendor for patch availability. Test the patched version against your SFTP use cases (file transfer performance, concurrent client limits, application compatibility) before rolling out to production. Rollback procedures should be documented, as downtime during testing is expected. For systems on very old OTP versions (pre-27), assess whether in-place upgrade is feasible or whether a planned migration timeline is required.

Detection guidance

Monitor SFTP server processes for: (1) Sustained high CPU usage by individual ssh_sftpd handler processes, particularly processes that do not cycle or terminate; (2) Rapid growth of message queue depth for a single channel (via Erlang observer, or erlang:process_info/2 queries); (3) High number of SFTP channels in a 'stuck' or non-responsive state (baseline the normal channel count and alert on spikes); (4) Network flows sending SSH extended-data messages (SSH_MSG_CHANNEL_EXTENDED_DATA, SSH message type 95) to SFTP channels—this is anomalous in normal SFTP operations and can be detected by SSH packet inspection or logging at the SSH library level. Correlate multiple looped channels from the same authenticated user or IP to identify coordinated attacks. Implement alerts on channel process death or restart rates, as manual killing of stuck channels may precede high-alert noise.

Why prioritize this

Despite the CVSS 4.3 (MEDIUM) rating, this vulnerability merits prompt patching in environments where SFTP availability is business-critical and where SFTP access is granted to multiple users or partners. The combination of low barrier to exploitation (post-auth, trivial trigger), easy amplification (unlimited channels), and absence of any compensating controls in the default configuration creates a practical denial-of-service risk. Organizations with strict SFTP availability SLAs or large concurrent SFTP user bases should prioritize patch testing and deployment. Conversely, if your deployment has very few SFTP users, tightly locked-down credentials, and operational tolerance for brief downtime, prioritization may be lower. In either case, interim controls (max_channels limit, network segmentation, monitoring) can meaningfully reduce risk while patches are staged.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a denial-of-service vulnerability with low complexity, requiring authenticated access (elevating the barrier slightly), and no confidentiality or integrity impact. The score appropriately de-emphasizes severity because no data is at risk and the attack does not compromise the host system. However, the practical risk is higher than the numeric score suggests if SFTP is mission-critical. The calculation does not fully capture the ease of amplification (unlimited channels) or the simplicity of the trigger, which increase operational risk. Use this score as a baseline; adjust your internal priority based on SFTP's role in your environment and user base composition.

Frequently asked questions