Erlang OTP ssh_sftp Authenticated DoS via Infinite Tail Recursion (CVE-2026-54886)

EEF-CVE-2026-54886 Vulnerability Overview Vulnerability Name: EEF-CVE-2026-54886 Vulnerability Type: Denial of Service (DoS) Vulnerability Description: An "infinite loop" vulnerability exists in Erlang OTP ssh (ssh_sftp module), allowing authenticated SFTP users to cause the SFTP server to become permanently unresponsive. CVSS Score: 5.3 (Medium) Impact Scope Affected Module: ssh_sftp module Trigger Conditions: An infinite tail recursion loop is triggered when channel data arrives with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA), the pending buffer is empty, and the payload is less than or equal to the SFTP packet size limit. Impact: The target ssh_sftp process enters an infinite tail recursion loop, rendering it unable to process other messages. The message queue grows unboundedly and can only be terminated by killing the process. The BEAM's reduction-based scheduler preemption continues to run, so processes on other nodes are not starved; however, each stuck channel process continuously consumes its entire CPU time slice and accumulates unbounded message queue memory. The greater the number of open channels, the greater the impact on CPU and memory. Configuration Impact: Erlang/OTP SSH configuration uses the default max_channels setting (infinite), allowing authenticated users to open an unlimited number of channels per connection. This amplifies the attack without requiring multiple TCP connections or additional authentications. Remediation Current Status: The page does not provide specific remediation instructions or patch information. Recommendation: Users are advised to monitor official updates and apply security patches promptly. Additional Information Source: CNA Link JSON Data: JSON Link JSON Data: API Link Aliases: CVE-2026-54886, OISA-Twp4-p2C7-2y9 Publication Date: 2026-07-02T16:06:20.502Z Modification Date: 2026-07-02T16:41:30.905591004Z

Goal Reached Thanks to every supporter — we hit 100%!

Erlang OTP ssh_sftp Authenticated DoS via Infinite Tail Recursion (CVE-2026-54886)