CVE-2026-68956: 
Erlang OTP Analyse et atténuation des vulnérabilités

CVE-2026-68956 is an SSH session channel exhaustion vulnerability in Erlang/OTP's SSH daemon that allows an authenticated remote attacker to crash the Erlang VM by exhausting node memory. The flaw affects OTP versions from 18.1.2 before 27.3.4.18, 28.5.0.7, and 29.1.1 (corresponding to ssh library versions 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6). It was published on September 22, 2026, and carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in the ssh_connection:handle_msg/4 function's "session" clause. When a session channel open request is received, the code checks only minimal_remote_max_packet_size before calling setup_session/5, which unconditionally builds a #channel{} record and stores it in the ETS channel cache — without consulting the max_channels limit. The max_channels daemon option was previously enforced only by ssh_channel_sup:max_num_channels_not_exceeded/2, which counts supervisor children; idle session channels that never receive a shell, exec, or subsystem handler are invisible to this check. Because RFC 4254 §5.1 permits many session channels per connection and each #channel{} record costs only a few hundred bytes, a single authenticated connection can accumulate an unbounded number of records until the Erlang VM runs out of memory and terminates (GitHub Advisory, Patch Commit).

Successful exploitation causes a complete denial of service: the Erlang VM crashes, terminating every application running on the affected node. Because the channel data is stored in ETS (not on a process heap), per-process memory limits (max_heap_size, +hmax) do not prevent the attack. There is no confidentiality or integrity impact — no file contents, credentials, or write access are obtainable through this vulnerability (GitHub Advisory).

No public proof-of-concept code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires valid SSH credentials but no special privileges, and a single authenticated connection is sufficient to trigger the attack. The EPSS score is approximately 0.475%, indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable (Feedly, GitHub Advisory).

1. Obtain valid SSH credentials: Acquire any valid username and password (or key) for the target Erlang/OTP SSH daemon — no elevated privileges are required.
2. Establish an SSH connection: Connect to the target daemon using any standard SSH client or library (e.g., Python's paramiko, OpenSSH, or a custom Erlang client).
3. Repeatedly open session channels without activating them: Send a large number of SSH_MSG_CHANNEL_OPEN messages with channel_type = "session" over the single connection, but do not send any subsequent shell, exec, or subsystem request on those channels. Each request causes the server to allocate a #channel{} record in its ETS cache.
4. Exhaust node memory: Continue opening channels until the Erlang VM's memory is exhausted. Because each record is only a few hundred bytes, tens of thousands of channels may be needed, but there is no server-side limit in affected versions.
5. Trigger VM crash: Once memory is exhausted, the Erlang emulator terminates, crashing all applications hosted on the node (GitHub Advisory).

• Network: A single SSH source IP maintaining one long-lived connection while generating a very high volume of SSH_MSG_CHANNEL_OPEN (session type) messages with no corresponding shell/exec/subsystem requests.
• Logs: Erlang/OTP SSH daemon logs showing a rapidly growing number of open channels from a single connection without any handler assignment; OTP crash dump files (erl_crash.dump) indicating memory exhaustion as the termination cause.
• Process/System: Sudden spike in memory consumption by the Erlang VM process (beam.smp) followed by process termination; OS-level OOM killer events targeting the Erlang emulator.
• ETS: Abnormally large ETS channel cache table size observable via ets:info/2 or monitoring tools before the crash.

Upgrade to a patched version: OTP 27.3.4.18, OTP 28.5.0.7, or OTP 29.1.1 (corresponding to ssh library versions 5.2.11.13, 5.5.2.6, or 6.0.6). Patched versions enforce max_channels at channel insertion time (via the new cache_insert/3 function) and change the defaults to max_channels = 256 and max_sessions = 1024. If immediate upgrade is not possible, partial mitigations include: setting max_sessions to a finite value to limit simultaneous connections; applying OS-level rate limiting (e.g., iptables connlimit) per source IP; constraining Erlang VM memory via cgroups or ulimit for a more controlled failure; and ensuring the SSH daemon is not reachable from untrusted networks. Note that idle_time, max_initial_idle_time, max_heap_size, and +hmax do not mitigate this vulnerability (GitHub Advisory, Patch Commit).