Erlang OTP SSH CVE-2026-54886

Exploitation requires a valid authenticated SFTP session on an Erlang OTP SSH server running an affected OTP version with the ssh_sftpd subsystem enabled. The attacker must be able to open an SSH channel and send a raw SSH_MSG_CHANNEL_EXTENDED_DATA message with any non-zero data_type_code and a non-empty payload not exceeding the SFTP packet size limit, while the sftpd pending buffer for that channel is empty (which is the default state before any SFTP packet is partially received). Limiting exploitation: the attacker must hold valid SSH credentials (PR:L per CVSS vector); no privilege escalation or special SFTP permissions are required beyond authentication. The amplification to full-node resource exhaustion is facilitated - but not required - by the default max_channels=infinity setting; even a single stuck channel degrades the node. No file access, code execution, or credential theft is possible through this path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) reflects a network-accessible, low-complexity flaw requiring authenticated access, with availability impact limited to the vulnerable system. The 5.3 medium score is broadly consistent with the description: the attack is straightforward once authenticated but cannot escalate to code execution or data exfiltration. No EPSS data was provided in the input; absent that signal, exploitation likelihood must be inferred from the low barrier (any valid SFTP credential suffices) and the simple primitive (a single malformed SSH message triggers the loop). No CISA KEV listing and no public POC are present, which reduces urgency for most environments. However, the amplification vector - default max_channels=infinity allows unlimited channels per authenticated session - elevates practical severity above the raw VA:L score suggests: a single authenticated attacker can progressively consume all CPU shares and exhaust memory on an SFTP node without re-authenticating. Organizations exposing OTP-based SFTP servers to semi-trusted or untrusted users (multi-tenant SFTP services, developer gateway hosts) face meaningfully higher real-world risk than the CVSS score alone conveys.

An authenticated user with valid SFTP credentials connects to an OTP SSH server and opens one or more SFTP subsystem channels. Instead of sending normal SFTP requests, they transmit SSH_MSG_CHANNEL_EXTENDED_DATA frames with any non-zero data_type_code and a non-empty payload below the SFTP packet size limit. Each targeted ssh_sftpd process immediately enters an infinite tail-recursive loop, consuming its CPU share continuously and accumulating incoming SSH messages in an ever-growing queue. By repeating the operation across many channels (permitted by the default max_channels=infinity), the attacker can saturate CPU and exhaust memory on the SFTP node without any additional authentication or TCP connections.