CVE-2026-77375 SFTPGo: Denial of service via malformed SSH channel request
An authenticated user can crash the SFTPGo server by sending a malformed SSH channel request, disrupting service for all users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77375?
CVE-2026-77375 is a medium-severity denial of service vulnerability in drakkan sftpgo, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.
Weakness: CWE-129
Which versions are affected by CVE-2026-77375?
4 open source packages ship an affected version, including github.com/drakkan/sftpgo/v2 and github.com/drakkan/sftpgo.
| Package | Affected | Fixed in |
|---|---|---|
github.com/drakkan/sftpgo/v2 Go | All versions | 2.7.5 |
github.com/drakkan/sftpgo/v2 Go | All versions | 2.7.5 |
github.com/drakkan/sftpgo/v2 Go | All versions | 2.7.5 |
github.com/drakkan/sftpgo Go | All versions | None |
How do I fix CVE-2026-77375?
Upgrade github.com/drakkan/sftpgo/v2 to 2.7.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-77375 being exploited?
There is no known exploitation of CVE-2026-77375 in the wild and no public exploit code.
Sources
Also known as GHSA-q7pc-356p-hggc, GO-2026-6792.