Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows excessive allocation and resource leak exposure, as the vulnerability is located within lib/ssh/src/ssh_sftpd.erl. Because the code that handles SFTP requests does not impose limits or throttling on the creation of file handles or other system resources, an attacker can generate a workload that forces the system to consume an unbounded number of descriptors. This uncontrolled consumption can exhaust file descriptors and related system resources, disabling legitimate connections or causing a denial of service for the host or services that depend on the SSH daemon.

The issue affects Erlang OTP releases from OTP 17.0 up to before OTP 28.0.3, and also specific intermediate releases OTP 27.3.4.3 and OTP 26.2.5.15. It also impacts the Erlang OTP ssh component in versions 3.0.1 through 5.3.3, 5.2.11.3, and 5.1.4.12, meaning any system running those Erlang OTP and SSH versions is vulnerable.

CVSS score 5.3 indicates moderate severity; EPSS score <1% shows very low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker must be able to establish SFTP connections against the vulnerable ssh service to trigger the resource exhaustion. Successful exploitation could exhaust file descriptors and related resources, potentially disrupting legitimate traffic or causing a denial of service for the host.