CVE-2026-77375

6.5Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-129

Impact

Authenticated SSH users can crash the SFTPGo daemon and disconnect all users by sending a malformed channel open message. Attackers only need valid login credentials to trigger the denial of service.

Root cause

Improper validation of array indices in malformed SSH channel open messages leads to an unhandled error that terminates the process.

Affected systems

SFTPGo versions prior to 2.7.5

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade SFTPGo to version 2.7.5 or later. If patching immediately is not possible, disable untrusted SSH accounts or place SFTPGo behind a process supervisor to automatically restart it on crashes.

shell

$ sftpgo --version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-77375