[ CVE-2026-77375 · Published 13 Oct 2026 ]
SFTPGo: Denial of service via malformed SSH channel request
CVSS 6.5
EPSS <1%Fix available
[ Description ]Official description
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.
[ Fixes ]Fixes and patches
- github.com/drakkan/sftpgo/v2 2.7.5Fixed version · GitHub Advisories · go package github.com/drakkan/sftpgo/v2: upgrade to 2.7.5 or later (affected <= 2.7.4)
[ Packages ]Affected open-source packages
- github.com/drakkan/sftpgo/v2 goAffected <= 2.7.4 · fixed in 2.7.5 · GHSA-q7pc-356p-hggc