Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are nev…
Info
Summary
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of ssh_connection:handle_msg/4 checks only minimal_remote_max_packet_size before calling setup_session/5, which unconditionally builds a #channel{} record and stores it in the ETS channel cache. The max_channels daemon option is consulted only by ssh_chan…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-68956.html
- https://github.com/erlang/otp/commit/79c2d2be17d902c5f53969b5806b725efda831be
- https://github.com/erlang/otp/commit/e18100975f0e5a8d59d02de00df12247a91b443b
- https://github.com/erlang/otp/commit/e2bbad0107bba41491a4d549686fd023db8740da
- https://github.com/erlang/otp/security/advisories/GHSA-qhcm-px9c-rvfh
- https://osv.dev/vulnerability/EEF-CVE-2026-68956
- https://www.erlang.org/doc/system/versions.html#order-of-versions
Timeline
- nvd_ingest NVD