All vulnerabilities
CVE-2026-77375GHSA-q7pc-356p-hggcGO-2026-6792

github.com/drakkan/sftpgo/v2: SFTPGo: Denial of service via malformed SSH channel request

drakkan github.com/drakkan/sftpgo/v2goLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.7.5Fixed versionGitHub
Published13 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2.7.5github.com/drakkan/sftpgo/v2, goGitHubgo get github.com/drakkan/sftpgo/v2@v2.7.5
  • 2.7.5github.com/drakkan/sftpgo/v2, GoOSVgo get github.com/drakkan/sftpgo/v2@v2.7.5

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel.

Impact

Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of service affecting all connected users until the service is restarted. No confidentiality or integrity impact has been identified; the issue is limited to availability.

Text from GitHub Advisory Database

Affected versions 3

  • github.com/drakkan/sftpgo/v2, go<= 2.7.4GitHub
  • sftpgoaffected: < 2.7.5CVE List
  • github.com/drakkan/sftpgo/v2, Gofrom first release, fixed in 2.7.5OSV

References 5