The vulnerability arises from the lack of resource limits in the Erlang OTP SSH server’s SFTP implementation. When an authenticated client issues repeated SSH_FXP_OPENDIR operations the program grows internal data structures without throttling, eventually exhausting the number of open file handles. This leads to denial‑of‑service of the SFTP service and may impact overall system availability if the ssh_sftpd process becomes unable to open new files. The weakness corresponds to resource‑exhaustion attacks (CWE‑400) and excessive allocation of system resources (CWE‑770).

Affected installations include Erlang OTP from version 17.0 through OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15. The corresponding SSH modules are available in OTP from 3.0.1 to 5.3.3, 5.2.11.3 and 5.1.4.12. Users running the OTP sshd with the SFTP server component on any of these releases are at risk, particularly those exposing SFTP services to untrusted or authenticated clients.

The CVSS score of 7.1 indicates a high impact vulnerability, while the EPSS score is below 1%, implying a low practical exploitation probability. Although the CVE description does not explicitly state authentication prerequisites, it is inferred that the attack would require access to an SFTP session because the vulnerability resides in the SSH_SFTP module that is only reachable after authentication. An attacker could repeatedly issue SSH_FXP_OPENDIR requests, causing the OTP sshd process to open many file handles until the system exhausts resources. The vulnerability is not listed in CISA KEV. Mitigation can be achieved by disabling or limiting SFTP usage; without an official patch the risk remains until a fixed OTP version is released.