CVE-2026-68956
Received Received - Intake

Allocation of Resources Without Limits or Throttling in Erlang/OTP ssh

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of ssh_connection:handle_msg/4 checks only minimal_remote_max_packet_size before calling setup_session/5, which unconditionally builds a #channel{} record and stores it in the ETS channel cache. The max_channels daemon option is consulted only by ssh_channel_sup:max_num_channels_not_exceeded/2, which counts supervisor children, so a channel that never gets a shell, exec, or subsystem handler is invisible to the limit and setting the option to a finite value does not mitigate the attack. RFC 4254 section 5.1 permits many session channels per connection, and each record costs only a few hundred bytes, so a single authenticated connection can accumulate channels until the node runs out of memory and the emulator terminates, affecting every application on it. No file contents, credentials, or write access are obtainable. This issue affects OTP from OTP 17.0 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to ssh from 3.0.1 before 5.2.11.13, 5.5.2.6, and 6.0.6. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-68956
EUVD
EUVD-2026-84339

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
erlang otp From 17.0 (inc) to 27.3.4.18 (exc)
erlang otp 28.5.0.7
erlang otp 29.1.1
erlang ssh From 3.0.1 (inc) to 5.2.11.13 (exc)
erlang ssh 5.5.2.6
erlang ssh 6.0.6
erlang otp to 27.3.4.18 (exc)
erlang otp to 28.5.0.7 (exc)
erlang otp to 29.1.1 (exc)
erlang ssh to 5.2.11.13 (exc)
erlang ssh to 5.5.2.6 (exc)
erlang ssh to 6.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Allocation of Resources Without Limits or Throttling issue in the Erlang/OTP SSH daemon. An authenticated remote attacker can exploit it by repeatedly opening session channels that are never assigned a handler. Each channel record consumes memory, and since the max_channels limit only applies to active channels, the attacker can accumulate idle channels until the node runs out of memory and crashes. No credentials or file access are obtained, but the entire Erlang VM is affected.

Detection Guidance

Monitor Erlang VM memory usage and SSH daemon logs for excessive channel creation. Check for connections with unusually high session channels using Erlang shell commands like 'ssh_connection:info().' or 'ets:i().' to inspect channel cache entries.

Impact Analysis

This vulnerability can cause a denial-of-service condition by crashing the Erlang VM due to memory exhaustion. It requires valid credentials but no special privileges, and a single authenticated connection is sufficient to trigger the attack. All applications running on the affected node will be disrupted until the system is restarted.

Compliance Impact

This vulnerability can lead to denial-of-service conditions by exhausting node memory, which may disrupt critical services handling sensitive data. For GDPR, this could impact availability of personal data processing systems. For HIPAA, it may cause disruptions in healthcare systems managing protected health information. The resulting downtime could violate availability requirements in both regulations.

Mitigation Strategies
  • Upgrade Erlang/OTP to patched versions (27.3.4.18, 28.5.0.7, 29.1.1) or SSH to versions (5.2.11.13, 5.5.2.6, 6.0.6) as per CVE details.
  • Restrict SSH access to trusted clients and users. Set max_sessions to a finite value and apply connection-rate limits.
  • Monitor node memory and restart the emulator if memory exceeds safe thresholds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68956. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart