GitHub Advisoryadvisory · Go

GHSA-q7pc-356p-hggc SFTPGo: Denial of service via malformed SSH channel request

MEDIUM Published 2026-10-15 Modified 2026-10-15 Official page ↗
Aliases
CVE-2026-77375
Ecosystem
Go
Packages
github.com/drakkan/sftpgo/v2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-129
Reviewed
2026-10-15

Affected packages

• Go github.com/drakkan/sftpgo/v2: < 2.7.5 → fixed in 2.7.5

Description

Summary A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel. Impact Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of service affecting all connected users until the service is restarted. No confidentiality or integrity impact has been identified; the issue is limited to availability.

Related

Alias · CVE (1)

  • CVE-2026-77375 SFTPGo is an open source, event-driven file transfer solution. vulnerability

Weakness · CWE (1)

  • CWE-129 Improper Validation of Array Index weakness

References