This vulnerability in Erlang OTP's ssh_sftp modules (lib/ssh/src/ssh_sftpd.erl) allows an attacker to cause uncontrolled resource consumption through excessive allocation or flooding. It affects OTP versions from 17.0 up to but not including OTP 28.0.3, OTP 27.3.4.3, and OTP 26.2.5.15, as well as ssh versions from 3.0.1 up to but not including 5.3.3, 5.2.11.3, and 5.1.4.12. The issue is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS 4.0 vector indicates the vulnerability is remotely exploitable without authentication or user interaction, with low attack complexity and low impact on confidentiality, integrity, and availability except for limited availability impact.

An attacker can exploit this vulnerability to cause excessive resource consumption on the affected system, potentially leading to denial of service conditions due to resource exhaustion. There is no indication of direct impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patches or fixes are referenced in the provided data. Users should monitor Erlang OTP vendor advisories for updates and apply official fixes once available. Until then, consider limiting exposure of the ssh_sftp service to untrusted networks to reduce risk.