CVE-2026-54886— Erlang/OTP 资源管理错误漏洞
一分钟漏洞结论
影响对象
Erlang OTP
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
erlang erlang/otp是erlang社区开源的一套并发编程语言及运行时系统。 Erlang/OTP存在资源管理错误漏洞，该漏洞源于ssh_sftpd模块的handle_data/4函数存在无法到达退出条件的循环（无限循环），导致经过身份验证的SFTP用户发送带有非零类型代码的数据时进入无限循环，从而使SFTP通道永久无响应。
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-54886 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
SSH SFTP server denial of service via extended channel data infinite loop
来源: CVE Program / CVE List V5
Vulnerability Description
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive.
The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop.
The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit.
The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact.
Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications.
No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth.
This vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4.
This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
来源: CVE Program / CVE List V5
Vulnerability Title
Erlang/OTP 资源管理错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
erlang erlang/otp是erlang社区开源的一套并发编程语言及运行时系统。 Erlang/OTP存在资源管理错误漏洞，该漏洞源于ssh_sftpd模块的handle_data/4函数存在无法到达退出条件的循环（无限循环），导致经过身份验证的SFTP用户发送带有非零类型代码的数据时进入无限循环，从而使SFTP通道永久无响应。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-54886 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-54886 的情报信息
请登录查看更多情报信息。
CVE-2026-54886 补丁与修复 (1)
CVE-2026-54886 厂商安全公告 (3)
同批安全公告 · Erlang · 2026-07-02 · 共 6 条
| CVE-2026-55950 | 8.7 HIGH | Erlang/OTP 竞争条件问题漏洞 |
| CVE-2026-55952 | 8.2 HIGH | Erlang/OTP 输入验证错误漏洞 |
| CVE-2026-54887 | 6.3 MEDIUM | Erlang/OTP 信任管理问题漏洞 |
| CVE-2026-54891 | 6.3 MEDIUM | Erlang/OTP 加密问题漏洞 |
| CVE-2026-53422 | 2.3 LOW | Erlang/OTP 侧信道信息泄露漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-54886
暂无评论