This vulnerability in Erlang OTP's ssh_sftp modules (lib/ssh/src/ssh_sftpd.erl) allows an attacker to cause uncontrolled resource consumption through excessive allocation or flooding. It affects OTP versions from 17.0 up to 28.0.3 and corresponding ssh versions from 3.0.1 to 5.3.3 and related sub-versions. The issue is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-770. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability, but with limited availability impact (VA:L). No patch or vendor advisory is currently referenced.

The vulnerability can lead to excessive resource consumption on affected systems running vulnerable versions of Erlang OTP ssh_sftp modules, potentially degrading service availability or causing denial of service conditions. There is no indication of direct confidentiality or integrity compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Erlang's official channels for updates. Until a fix is available, consider limiting exposure of vulnerable ssh_sftp services to untrusted networks and applying resource usage limits where possible to mitigate impact.