The vulnerability is a resource-allocating bug in Erlang OTP’s SSH SFTP module (ssh_sftpd). It allows an attacker to cause excessive allocation and flooding of file handles because the module does not impose limits or throttling. Repeated SFTP directory requests (SSH_FXP_OPENDIR) can exhaust file descriptors available to the sshd process, leading to denial of service for the SFTP service and potentially disrupting overall system availability. The flaw exists in OTP releases from 17.0 up through 27.3.4.3 and 26.2.5.15, which map to SSH versions 3.0.1 through 5.3.3, 5.2.11.3, and 5.1.4.12.

Affected installations include Erlang OTP from version 17.0 up to, but not including, 28.0.3, specifically versions 27.3.4.3 and 26.2.5.15. The corresponding SSH modules for these OTP releases are the ssh packages from 3.0.1 through 5.3.3, 5.2.11.3, and 5.1.4.12 respectively. Using the OTP sshd with the SFTP server component on any of these releases exposes users to this vulnerability, especially when SFTP services are available to untrusted or authenticated clients.

The CVSS score of 7.1 indicates a high impact vulnerability, while the EPSS score is below 1%, implying a low practical exploitation probability. Although the CVE description does not explicitly state authentication prerequisites, it is inferred that the attack would require access to an SFTP session because the vulnerability resides in the SSH_SFTP module that is only reachable after authentication. An attacker could repeatedly issue SFTP directory requests, causing the OTP sshd process to open many file handles until the system exhausts resources. The vulnerability is not listed in CISA KEV. Mitigation can be achieved by disabling or limiting SFTP usage; without an official patch the risk remains until a fixed OTP version is released.