CVE-2026-77375
Deferred Deferred - Pending Action

Authenticated SSH Channel Handling Denial of Service in SFTPGo

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-77375
EUVD
EUVD-2026-98780

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
drakkan sftpgo < 2.7.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in SFTPGo, an open source file transfer solution. An authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that crashes the server process. This affects all connected users until the server is restarted.

Detection Guidance

Detecting this vulnerability requires checking the SFTPGo server version. If your version is below 2.7.5, the system is vulnerable. Use commands like 'sftpgo version' or check package managers (e.g., 'apt list --installed | grep sftpgo') to verify the installed version.

Impact Analysis

The vulnerability can cause the SFTPGo server to crash, disrupting all active file transfer sessions. Users may experience interrupted connections and temporary unavailability of the service until the server is restarted.

Compliance Impact

The vulnerability may impact compliance by causing service disruptions, potentially leading to downtime that violates availability requirements in GDPR or HIPAA. However, no confidentiality or integrity impact has been identified.

Mitigation Strategies

Upgrade SFTPGo to version 2.7.5 or later immediately. Restart the SFTPGo service after upgrading to apply the fix. Ensure no unauthenticated users have access during the upgrade to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart