Infinite Loop Vulnerability in Erlang OTP SFTP Module

CVE-2026-54886

What is CVE-2026-54886?

The Erlang OTP SFTP module is affected by a vulnerability that allows an authenticated SFTP user to cause a denial of service by triggering an infinite loop with non-standard channel data. When the handle_data/4 function is called with a non-zero type code while the pending buffer is empty, the function enters an infinite recursive loop. This results in the unresponsiveness of the SFTP channel as it consumes CPU resources and grows the message queue uncontrollably. Although the impact is limited to denial of service, the issue can be significantly amplified by the default configuration allowing unlimited channel openings per connection.

References