CVE-2026-77375: SFTPGo: Denial of service via malformed SSH channel request
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SFTPGoto a version that resolves this vulnerability.Fixed in 2.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SSH user can trigger the denial of service. The attack can be performed remotely and does not require user interaction.
What is the operational impact if exploitation succeeds?
A malformed SSH channel-opening message causes an unhandled error that terminates the SFTPGo server process. All connected users are affected until the service is restarted; no confidentiality or integrity impact has been identified.
Which versions need to be remediated?
SFTPGo versions prior to 2.7.5 are affected. Upgrade to version 2.7.5, which fixes the issue.