The vulnerability resides in the SSH/SFTP component of Erlang OTP where unverified paths allow the system to allocate resources without any limits or throttling. Attackers can exploit this by initiating excessive file transfer sessions, resulting in uncontrolled consumption of memory, file descriptors, or other critical resources, which may culminate in a denial of service. The weakness is described by CWE-400 and CWE-770, indicating uncontrolled resource consumption and insufficient resource limits.

The flaw affects Erlang:OTP releases from 17.0 through 28.0.3, including specific sub‑releases 27.3.4.3 and 26.2.5.15. The impacted SSH module versions span from 3.0.1 to 5.3.3, 5.2.11.3, and 5.1.4.12, as detailed in the CVE description.

With a CVSS score of 5.3, the vulnerability presents a medium severity. The EPSS score is below 1% and the flaw is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. The likely attack vector is remote via the SFTP subsystem, where an attacker can create many concurrent connections to trigger the resource leak. The vendor’s recommended interim measures include disabling SFTP support or limiting the maximum number of concurrent SSH sessions to reduce the exploitation surface.