Executive brief
The SSH daemon in Erlang/OTP fails to enforce limits on idle session channels, allowing an authenticated attacker to exhaust server memory by repeatedly opening session channels that are never assigned handlers. This causes the entire Erlang node to run out of memory and crash, affecting all applications running on that node and resulting in a denial of service.
Technical details
The vulnerability exists in ssh_connection:handle_msg/4, which creates #channel{} records and stores them in an ETS cache without enforcing the max_channels limit; the limit only checks supervisor children, so channels without handlers bypass the check entirely. An authenticated remote attacker can open many idle session channels over a single SSH connection to accumulate memory until the emulator terminates. The attack requires prior authentication and network access to the SSH daemon.
Affected products
- Erlang OTP 18.1.2 through 27.3.4.17, 28.0.0 through 28.5.0.6, 29.0.0 through 29.1.0
Timeline
- 2026-09-22: disclosed
- 2026-09-24: advisory: CNA advisory published