Vulnerability · Published Oct 13, 2026 · Assigned by GitHub_M
CVE-2026-77375SFTPGo: Denial of service via malformed SSH channel request
Medium 6.5
In plain English
A medium-severity security flaw in sftpgo from drakkan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/drakkan/sftpgo | no fix listed | GO-2026-6792 |
| Go | github.com/drakkan/sftpgo/v2 | 2.7.5 | GHSA-q7pc-356p-hggc |
| Go | github.com/drakkan/sftpgo/v2 | 2.7.5 | GO-2026-6792 |
Affected products (as reported)
Weakness: CWE-129 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/drakkan/sftpgo/security/advisories/GHSA-q7pc-356p-hggc x_refsource_CONFIRM
- https://github.com/drakkan/sftpgo/commit/4f751232d7025cf2f7360e01ee8dca81e74b48b0 x_refsource_MISC
- https://github.com/drakkan/sftpgo/releases/tag/v2.7.5 x_refsource_MISC