SFTPGo: Denial of service via malformed SSH channel request

TRUNG BÌNH 6.5CVE-2026-77375 · GHSA-q7pc-356p-hggc · GO-2026-6792 · Công bố 13/10/2026 · cập nhật 13/10/2026

Tóm tắt nhanh

CVE-2026-77375 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.31%, cao hơn 23.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.7.5 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/drakkan/sftpgo Go	`mọi phiên bản`	Chưa có bản vá
github.com/drakkan/sftpgo/v2 Go	`< 2.7.5`	`2.7.5`

Mô tả

Summary

A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel.

Impact

Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of service affecting all connected users until the service is restarted. No confidentiality or integrity impact has been identified; the issue is limited to availability.

Mô tả của NVD

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.