The vulnerability arises from uncontrolled allocation of system resources within the Erlang OTP SSH/SFTP subsystem, specifically in the lib/ssh/src/ssh_sftpd.erl module. When the system processes SFTP requests, it can allocate memory, file descriptors, or other resources without limits, leading to an excessive or leaking usage pattern. This flaw can ultimately cause service degradation or complete denial of service for users depending on the affected SSH/SFTP service.

It impacts Erlang:OTP releases from 17.0 through at least 28.0.3, including sub‑releases 27.3.4.3 and 26.2.5.15. Correspondingly, the SSH module versions affected span from 3.0.1 up to 5.3.3, 5.2.11.3, and 5.1.4.12, as stated in the official description.

With a CVSS score of 5.3, the vulnerability is classified as medium severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of current exploitation. Based on the description, it is inferred that the attack vector would be remote through the SFTP interface, where an attacker could flood the daemon with many concurrent connections or large file transfers to trigger the resource leak. The vendor’s recommended interim measures include disabling SFTP in the SSH configuration or limiting the maximum number of concurrent SSH sessions, which would make exploitation more difficult.