CVE-2026-68956
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
The ssh library in Erlang/OTP contains an Allocation of Resources Without Limits or Throttling vulnerability. An authenticated remote attacker can exhaust node memory by repeatedly opening session channels that are never assigned a handler. This affects OTP from 18.1.2 before 27.3.4.18, 28.5.0.7, and 29.1.1 (corresponding to ssh from 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6).
Risk Assessment
A single authenticated connection can accumulate channels until the node runs out of memory and the emulator terminates, affecting every application on it. No file contents, credentials, or write access are obtainable.
Recommendation
Update Erlang/OTP to version 27.3.4.18, 28.5.0.7, or 29.1.1 (or later), corresponding to ssh versions 5.2.11.13, 5.5.2.6, or 6.0.6.
Other vulnerabilities in Erlang/OTP ssh
See all- CVE-2026-54886Medium
An infinite loop vulnerability in the ssh_sftpd module of Erlang/OTP SSH allows an authenticated SFTP user to permanently block an SFTP channel. By sending extended data (SSH_MSG_CHANNEL_EXTENDED_DATA) with a non-zero type code, the attacker causes the handle_data/4 function to loop indefinitely, preventing further message processing on that channel.
- CVE-2026-53422Medium
A vulnerability in the ssh_sftpd module of the SSH server in OTP (Erlang) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The issue stems from improper path handling in the SSH_FXP_REALPATH handler, which does not canonicalize the path before checking restrictions.
- CVE-2026-48859Medium
Erlang/OTP ssh (ssh_auth, ssh_options modules) has an observable timing discrepancy vulnerability. With user_passwords or password option enabled, password checking for valid usernames takes ~300ms, while for invalid ones ~0ms, allowing unauthenticated remote username enumeration.
- CVE-2026-48855Medium
Erlang OTP ssh (ssh_sftpd module) has an information disclosure vulnerability. The SSH_FXP_READLINK handler sends the raw result of file:read_link/2 without stripping the backend root prefix, allowing an authenticated SFTP client to discover the absolute path of the SFTP directory. Affects OTP from 17.0 before 27.3.4.13, 28.5.0.2, and 29.0.2.
- CVE-2026-32147Medium
A Path Traversal vulnerability in the ssh_sftpd module of Erlang OTP ssh allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of ssh_connection:handle_msg/4 checks only minimal_remote_max_packet_size before calling setup_session/5, which unconditionally builds a #channel{} record and stores it in the ETS channel cache. The max_channels daemon option is consulted only by ssh_channel_sup:max_num_channels_not_exceeded/2, which counts supervisor children, so a channel that never gets a shell, exec, or subsystem handler is invisible to the limit and setting the option to a finite value does not mitigate the attack. RFC 4254 section 5.1 permits many session channels per connection, and each record costs only a few hundred bytes, so a single authenticated connection can accumulate channels until the node runs out of memory and the emulator terminates, affecting every application on it. No file contents, credentials, or write access are obtainable. This issue affects OTP from OTP 18.1.2 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to ssh from 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6. Whether OTP before OTP 18.1.2, corresponding to ssh before 4.1.1, is affected is unknown.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS