Is CVE-2026-77375 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77375 being exploited in the wild.

How severe is CVE-2026-77375?

Medium severity, with a CVSS score of 6.5, published 13 October 2026.

Which products and versions are affected?

Drakkan SFTPGo 2.7.4 and earlier; github.com/drakkan/sftpgo (Go) SEMVER:introduced=0; github.com/drakkan/sftpgo/v2 (Go) <= 2.7.4, SEMVER:introduced=0,fixed=2.7.5.

Is there a fix for CVE-2026-77375?

Yes. github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77375 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-77375?

Check whether you run Drakkan SFTPGo, github.com/drakkan/sftpgo (Go) or github.com/drakkan/sftpgo/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77375: SFTPGo denial of service via malformed SSH channel request

Q: Is there a fix for CVE-2026-77375?

Yes. github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77375 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-77375?

Check whether you run Drakkan SFTPGo, github.com/drakkan/sftpgo (Go) or github.com/drakkan/sftpgo/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77375 · Severity: medium · CVSS 6.5 · Published 2026-10-13

SFTPGo is a file transfer service that supports SSH/SFTP connections for secure remote file access. An authenticated user can crash the server by sending a specially crafted SSH message, causing denial of service to all connected users until the service restarts. No data theft or corruption is possible from this flaw.

Technologies: github.com/drakkan/sftpgo (Go), github.com/drakkan/sftpgo/v2 (Go). Vendors: Drakkan, Go.

Quick answers

Is CVE-2026-77375 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77375 being exploited in the wild.
How severe is CVE-2026-77375?: Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?: Drakkan SFTPGo 2.7.4 and earlier; github.com/drakkan/sftpgo (Go) SEMVER:introduced=0; github.com/drakkan/sftpgo/v2 (Go) <= 2.7.4, SEMVER:introduced=0,fixed=2.7.5.
Is there a fix for CVE-2026-77375?: Yes. github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77375 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-77375?: Check whether you run Drakkan SFTPGo, github.com/drakkan/sftpgo (Go) or github.com/drakkan/sftpgo/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.5 or later
```
go get github.com/drakkan/sftpgo/v2@v2.7.5
```

Technical details

An improper validation of array index (CWE-129) in the SSH service's channel request handling allows an authenticated attacker to trigger an unhandled error that aborts the server process. The vulnerability requires prior SSH authentication and network access, and results in immediate unavailability of the service.

Affected products

drakkan SFTPGo 2.7.4 and earlier

Identifiers

CVE-2026-77375
GHSA-q7pc-356p-hggc
GO-2026-6792

Timeline

2026-07-17: disclosed
2026-10-15: advisory

References

https://api.github.com/users/arnimar

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.