CVE-2026-54886: erlang/otp from 17.0 (inclusive), before 27.3.4.14 (exclusive), from 28.0 (inclusive), before 28.5.0.3 (exclusive)…

Affected technology

erlang/otp · from 17.0 (inclusive), before 27.3.4.14 (exclusive)
erlang

erlang/otp · from 28.0 (inclusive), before 28.5.0.3 (exclusive)
erlang

erlang/otp · from 29.0 (inclusive), before 29.0.3 (exclusive)
erlang

erlang/ssh · from 3.0.1 (inclusive), before 5.2.11.9 (exclusive)
erlang

erlang/ssh · from 5.3 (inclusive), before 5.5.2.2 (exclusive)
erlang

erlang/ssh · from 6.0 (inclusive), before 6.0.2 (exclusive)
erlang

OTP · 3.0.1 to before *; status changes: 6.0.2 — unaffected, 5.5.2.2 — unaffected, 5.2.11.9 — unaffected
Erlang

OTP · 17.0 to before *; status changes: 29.0.3 — unaffected, 28.5.0.3 — unaffected, 27.3.4.14 — unaffected, 84adefa3318eef8631bf25cd233246a86eea18cd to before eaf9550b8ad4738b81149d3f617102d980c6dd18
Erlang

Component: ssh_sftpd
Function: ssh_sftpd:handle_data/4, in
File: src/ssh_sftpd.erl, lib/ssh/src/ssh_sftpd.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated SFTP user can render an SFTP channel permanently unresponsive. Source advisory’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low.