{"id":"CVE-2026-77375","kind":"vulnerability","aliases":["CVE-2026-77375","GHSA-q7pc-356p-hggc","GO-2026-6792"],"related":[],"title":"SFTPGo: Denial of service via malformed SSH channel request in github.com/drakkan/sftpgo","description":"SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.","summary":"SFTPGo, a Go file transfer server, crashes when an authenticated SSH user sends a malformed message while opening a channel. An attacker with a valid SSH login can take the server down for all connected users until it is restarted.","severity":"medium","cvss":6.5,"epss":0.00308,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/drakkan/sftpgo","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/drakkan/sftpgo/v2","fixed":["2.7.5"],"affected":"< 2.7.5","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","sftp"],"not_affected_if":["no-untrusted-ssh-users","sftp-disabled"],"how_to_check":"Check the version of the sftpgo binary or the go.mod entry for github.com/drakkan/sftpgo/v2; anything below 2.7.5 is affected.","fix":"Upgrade github.com/drakkan/sftpgo/v2 to 2.7.5 or later.\nRestart the service after upgrading.","status":"open","published_at":"2026-10-13T15:17:49+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:57:50+00:00","updated_at":"2026-10-23T19:57:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:57:50Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/drakkan/sftpgo/v2 to 2.7.5 or later.\nRestart the service after upgrading.","summary":"SFTPGo, a Go file transfer server, crashes when an authenticated SSH user sends a malformed message while opening a channel. An attacker with a valid SSH login can take the server down for all connected users until it is restarted.","category":"package","who_cares":["go","self-hosted","sftp"],"confidence":0.8,"analyst_note":"","how_to_check":"Check the version of the sftpgo binary or the go.mod entry for github.com/drakkan/sftpgo/v2; anything below 2.7.5 is affected.\nunknown","needs_analyst":false,"not_affected_if":["sftp-disabled","no-untrusted-ssh-users"],"severity_if_unknown":"medium"},"cost_usd":0.000367,"input_tokens":2194,"output_tokens":296,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A,26A '-6792':24A '-77375':16A,27A '/drakkan/sftpgo':13A,30A '/drakkan/sftpgo/v2':33A '2.7.5':93C,137C '356p':20A 'affect':118C 'attack':61B 'authent':49B,95C 'caus':108C 'channel':8A,59B,107C 'confidenti':125C 'connect':74B,120C 'crash':46B 'cve':14A,25A 'denial':2A 'driven':87C 'error':111C 'event':86C 'event-driven':85C 'file':43B,88C 'fix':135C 'ghsa':18A 'ghsa-q7pc-356p-hggc':17A 'github.com':12A,29A,32A 'github.com/drakkan/sftpgo':11A,28A 'github.com/drakkan/sftpgo/v2':31A 'go':22A,34B,42B 'hggc':21A 'host':38B 'identifi':131C 'impact':128C 'integr':127C 'issu':133C 'login':66B 'malform':6A,54B,101C 'messag':55B,103C 'open':57B,83C,105C 'packag':35B 'prior':91C 'process':116C 'protocol':102C 'q7pc':19A 'request':9A 'restart':79B,123C 'self':37B 'self-host':36B 'send':52B,99C 'server':45B,70B,115C 'servic':4A 'sftp':39B 'sftpgo':1A,40B,80C 'solut':90C 'sourc':84C 'ssh':7A,50B,65B,96C 'take':68B 'termin':113C 'transfer':44B,89C 'unhandl':110C 'user':51B,75B,97C,121C 'valid':64B 'via':5A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-13T15:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6792","url":"https://pkg.go.dev/vuln/GO-2026-6792","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77375","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77375","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77375","severity":null,"published_at":"2026-10-13T15:17:49+00:00","modified_at":"2026-10-13T16:17:22+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}