Uncontrolled resource consumption is possible in the Erlang OTP SSH SFTP daemon when a malicious client sends specially crafted key‑exchange messages. The vulnerability causes the server to allocate excessive memory or other resources, leading to flooding and eventual denial of service. It aligns with CWE‑400 and CWE‑770 weaknesses.

The flaw is present in Erlang/OTP releases from version 17.0 up to and including 28.0.3, as well as 27.3.4.3 and 26.2.5.15. The issue resides in the ssh_sftpd module (lib/ssh/src/ssh_sftpd.erl) and affects SSH/SFTP servers using OTP‑provided SSH binaries from 3.0.1 through 5.3.3, 5.2.11.3, and 5.1.4.12.

The CVSS base score of 6.9 denotes moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, an attacker could exploit the weakness from the network by initiating an SSH connection and super‑regularly demanding key‑exchange, thereby stressing the target’s resources. The recommended approach is to apply a vendor patch or upgrade, as the official fixes are available in newer OTP releases; in the interim, disabling parallel logins and lowering max_sessions reduces potential impact.