CVE-2026-77375: SFTPGo: Denial of service via malformed SSH channel request
Summary
A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel.
Impact
Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of service affecting all connected users until the service is restarted. No confidentiality or integrity impact has been identified; the issue is limited to availability.
Other sources
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/drakkan/sftpgo/v2to a version that resolves this vulnerability.Fixed in 2.7.5 - Upgrade
Upgrade
SFTPGoto a version that resolves this vulnerability.Fixed in 2.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SSH user can trigger the denial of service. The attack can be performed remotely and does not require user interaction.
What is the operational impact if exploitation succeeds?
A malformed SSH channel-opening message causes an unhandled error that terminates the SFTPGo server process. All connected users are affected until the service is restarted; no confidentiality or integrity impact has been identified.
Which versions need to be remediated?
SFTPGo versions prior to 2.7.5 are affected. Upgrade to version 2.7.5, which fixes the issue.