This vulnerability (CWE-770) in Erlang/OTP ssh occurs because the 'session' clause of ssh_connection:handle_msg/4 only checks minimal_remote_max_packet_size before creating a channel record and storing it in the ETS channel cache. The max_channels daemon option limits only channels with assigned handlers by counting supervisor children, so channels without shell, exec, or subsystem handlers bypass this limit. As RFC 4254 section 5.1 permits many session channels per connection, an attacker with authentication can open many such channels, each consuming memory, eventually exhausting node memory and causing the emulator to terminate. Affected OTP versions are from 17.0 up to but excluding 27.3.4.18, 28.5.0.7, and 29.1.1, corresponding to ssh versions from 3.0.1 up to but excluding 5.2.11.13, 5.5.2.6, and 6.0.6. It is unknown if versions before OTP 17.0 are affected.

An authenticated remote attacker can cause a denial of service by exhausting the node's memory through repeated opening of session channels without handlers. This leads to termination of the Erlang emulator, affecting all applications running on the node. No unauthorized data access or modification is possible through this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Setting the max_channels option to a finite value does not mitigate this attack because channels without handlers are not counted. Until an official fix is available, restrict authenticated access to trusted users only and monitor for unusual ssh session channel activity.