CVE-2026-68956: Erlang/OTP SSH Memory Exhaustion DOS Vulnerability

CVE-2026-68956 Overview

CVE-2026-68956 is a resource exhaustion vulnerability in the Erlang/OTP ssh application. An authenticated remote attacker can exhaust node memory by repeatedly opening SSH session channels that are never assigned a handler. Because these channels bypass the max_channels limit, a single connection can accumulate records until the Erlang emulator terminates, taking down every application running on the node. The flaw is tracked under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
A single authenticated SSH session can crash the entire Erlang node, affecting all applications hosted on it. No file contents, credentials, or write access are exposed.

Affected Products

Erlang/OTP from OTP 18.1.2 before OTP 27.3.4.18
Erlang/OTP 28 before OTP 28.5.0.7
Erlang/OTP 29 before OTP 29.1.1 (ssh from 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6)

Discovery Timeline

2026-09-22 - CVE-2026-68956 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-68956

Vulnerability Analysis

The vulnerability resides in ssh_connection:handle_msg/4, which handles inbound SSH_MSG_CHANNEL_OPEN requests. When processing a session channel type, the function only validates minimal_remote_max_packet_size before invoking setup_session/5. That helper unconditionally constructs a #channel{} record and stores it in the ETS channel cache.

Operators typically rely on the max_channels daemon option to bound per-connection resource use. However, that limit is enforced by ssh_channel_sup:max_num_channels_not_exceeded/2, which counts supervisor children rather than cache entries. A channel that is opened but never bound to a shell, exec, or subsystem handler never becomes a supervisor child, so it is invisible to the limit.

Root Cause

RFC 4254 section 5.1 permits many session channels per connection. Each #channel{} record consumes only a few hundred bytes, but nothing caps the number of unhandled entries in the ETS cache. Setting max_channels to any finite value does not mitigate the issue because the accounting path never sees these orphan channels.

Attack Vector

An attacker authenticates to the Erlang/OTP SSH daemon with valid credentials, then repeatedly issues SSH_MSG_CHANNEL_OPEN requests of type session without following up with shell, exec, or subsystem requests. Each request adds a record to the channel cache. Over time, memory consumption grows until the Erlang VM runs out of memory and the emulator terminates, producing a denial-of-service condition across every application co-located on the node.

text

// Patch excerpt: lib/ssh/src/ssh_channel_sup.erl
-behaviour(supervisor).
--include("ssh.hrl").

--export([start_link/1, start_child/8]).
+-export([start_link/1, start_child/7]).

// Source: https://github.com/erlang/otp/commit/79c2d2be17d902c5f53969b5806b725efda831be

The fix redefines what counts against max_channels. Per the updated documentation:

text

// Patch excerpt: lib/ssh/src/ssh.hrl
- **`max_channels`** - The maximum
-  number of channels with active remote subsystem that are accepted for each
-  connection to this daemon
+  number of channels that are accepted for each connection to this daemon. This
+  includes channels that are automatically opened when a port forwarding request
+  is serviced by the server.

// Source: https://github.com/erlang/otp/commit/79c2d2be17d902c5f53969b5806b725efda831be

Detection Methods for CVE-2026-68956

Indicators of Compromise

Sudden growth in Erlang VM memory consumption tied to a single authenticated SSH session.
Unusually high count of channel-open messages of type session from the same client without corresponding shell, exec, or subsystem requests.
Node crashes with system_limit or out-of-memory reports on hosts running Erlang/OTP SSH daemons.

Detection Strategies

Instrument the SSH daemon to log channel lifecycle events and alert when open-to-handler ratios diverge on a per-connection basis.
Monitor ETS table sizes for ssh_channel caches and trigger alerts when entry counts grow beyond expected baselines.
Correlate authentication logs with process memory metrics to attribute VM pressure to specific SSH principals.

Monitoring Recommendations

Track erlang:memory/0 totals and ets:info/2 sizes for SSH channel caches through Prometheus or a comparable telemetry pipeline.
Alert on repeated SSH_MSG_CHANNEL_OPEN messages from a single connection without follow-up channel requests within a short window.
Ship SSH daemon logs into a central data lake for retrospective analysis of session behavior across the fleet.

How to Mitigate CVE-2026-68956

Immediate Actions Required

Upgrade Erlang/OTP to 27.3.4.18, 28.5.0.7, or 29.1.1 depending on the deployed major version.
Restrict network exposure of Erlang/OTP SSH daemons to trusted management networks until patched.
Rotate or disable low-trust SSH credentials that could be leveraged by an authenticated attacker.

Patch Information

Fixes are available across supported branches via the commits 79c2d2b, 84df3d4d, e181009, and e2bbad01. See the GitHub Security Advisory GHSA-qhcm-px9c-rvfh and the CNA advisory for the complete list of patched versions.

Workarounds

Enforce strict authentication policies and limit SSH access to a minimal set of trusted principals.
Terminate long-lived SSH sessions that exhibit anomalous channel-open activity through orchestration or network-layer controls.
Run the Erlang/OTP SSH daemon under an OS-level memory cgroup so that a crash contains blast radius while patches are staged.

bash

# Verify installed Erlang/OTP version
erl -eval 'erlang:display(erlang:system_info(otp_release)), halt().' -noshell

# Confirm ssh application version
erl -eval 'application:load(ssh), {ok, V} = application:get_key(ssh, vsn), erlang:display(V), halt().' -noshell