This vulnerability in Erlang OTP's ssh_sftp modules (lib/ssh/src/ssh_sftpd.erl) involves allocation of resources without proper limits or throttling, categorized under CWE-770 and CWE-400. Affected versions include OTP releases from 17.0 through 28.0.3 and certain patch versions. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. The vulnerability could allow an attacker to cause excessive resource consumption or resource leaks, potentially impacting system stability or availability.

The vulnerability allows excessive allocation of resources without limits or throttling, which can lead to resource exhaustion or leaks in systems running affected Erlang OTP versions. This may degrade system performance or availability but does not indicate direct code execution or data compromise. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, monitor Erlang's official channels for updates. Until a fix is released, consider limiting exposure of affected ssh_sftp services and applying resource usage controls at the system or network level if feasible.