Skip to content
Fencer Vulns
medium 4.3

CVE-2026-54886 json

SSH SFTP server denial of service via extended channel data infinite loop

published 2026-07-02 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-41413

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits
0
none known

Summary

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive.

The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop.

The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit.

The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact.

Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications.

No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth.

This vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4.

This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.

Patch / fix

  • Erlang OTP 5.2.11.9, 5.5.2.2, 6.0.2, 27.3.4.14, 28.5.0.3, 29.0.3
  • erlang Debian 13 1:27.3.4.1+dfsg-1+deb13u3
  • erlang Debian 14 1:29.0.3+dfsg-1

debian advisories DEBIAN-CVE-2026-54886

  • erlang Ubuntu 22.04 LTS 1:24.2.1+dfsg-1ubuntu0.8
  • erlang Ubuntu 24.04 LTS 1:25.3.2.8+dfsg-1ubuntu4.8
  • erlang Ubuntu 26.04 LTS 1:27.3.4.6+dfsg-1ubuntu0.2
  • erlang Ubuntu Pro 14.04 LTS 1:16.b.3-dfsg-1ubuntu2.2+esm3
  • erlang Ubuntu Pro 16.04 LTS 1:18.3-dfsg-1ubuntu3.1+esm4
  • erlang Ubuntu Pro 18.04 LTS 1:20.2.2+dfsg-1ubuntu2+esm4
  • erlang Ubuntu Pro 20.04 LTS 1:22.2.7+dfsg-1ubuntu0.5+esm3

ubuntu advisories UBUNTU-CVE-2026-54886

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • erlang27 hummingbird 1 27.3.4.17-1.hum1
  • erlang27-et hummingbird 1 27.3.4.17-1.hum1
  • erlang27-wx hummingbird 1 27.3.4.17-1.hum1
  • erlang27-ftp hummingbird 1 27.3.4.17-1.hum1
  • erlang27-ssh hummingbird 1 27.3.4.17-1.hum1
  • erlang27-ssl hummingbird 1 27.3.4.17-1.hum1
  • erlang27-asn1 hummingbird 1 27.3.4.17-1.hum1
  • erlang27-edoc hummingbird 1 27.3.4.17-1.hum1

red hat advisories RHSA-2026:63160

  • erlang SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 23.3.4.19-150300.3.39.1
  • erlang26 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Server Applications 15 SP7 26.2.1-150300.7.28.1

suse advisories SUSE-SU-2026:3645-1SUSE-SU-2026:3579-1

  • erlang openSUSE Tumbleweed 28.5.0.4-1.1
  • erlang27 openSUSE Tumbleweed 27.1.3-3.1

opensuse advisories openSUSE-SU-2026:11559-1openSUSE-SU-2026:11560-1

  • erlang Azure Linux 3.0 26.2.5.21-4

azure linux advisories AZL-92021

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54886 updated cvss 6.5

erlang: Erlang OTP ssh: Denial of Service via infinite loop in SFTP channel

  • Red Hat OpenStack Platform 16.2 erlang, erlang-ssl, erlang-asn1, erlang-erts, erlang-hipe, erlang-sasl, +15 more Red Hat OpenStack Platform 17.1 erlang-ssl, erlang-asn1, erlang-erts, erlang-sasl, erlang-snmp, erlang-eldap, +13 more Red Hat OpenStack Platform 18.0 erlang
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images erlang27 27.3.4.17-1.hum1
    fixed: vendor fix RHSA-2026:63160

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Erlang OTP

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.