This vulnerability involves allocation of resources without proper limits or throttling in the Erlang OTP ssh_sftp modules, specifically in the ssh_sftpd.erl file. It can lead to excessive allocation and flooding conditions, potentially impacting system stability or availability. The affected versions include OTP from 17.0 up to but not including 28.0.3, 27.3.4.3, and 26.2.5.15, and ssh from 3.0.1 before 5.3.3, 5.2.11.3, and 5.1.4.12. The CVSS 4.0 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability.

The vulnerability allows an attacker to cause excessive resource allocation and flooding via the ssh_sftp modules, which may lead to denial of service or degraded system performance. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Erlang OTP vendor advisories for updates. Until a fix is available, consider limiting exposure of the affected ssh_sftp services and applying any recommended configuration changes from the vendor.