# CVE-2026-77375: SFTPGo denial of service via malformed SSH channel request

Source: https://junglewise.ai/threats/cve-2026-77375-sftpgo-denial-of-service-via-malformed-ssh-channel-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-77375 · Severity: medium · CVSS 6.5 · Published 2026-10-13

SFTPGo is a file transfer service that supports SSH/SFTP connections for secure remote file access. An authenticated user can crash the server by sending a specially crafted SSH message, causing denial of service to all connected users until the service restarts. No data theft or corruption is possible from this flaw.

Technologies: [github.com/drakkan/sftpgo (Go)](https://junglewise.ai/threats/technologies/github-com-drakkan-sftpgo), [github.com/drakkan/sftpgo/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-drakkan-sftpgo-v2). Vendors: [Drakkan](https://junglewise.ai/threats/vendors/drakkan), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-77375 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77375 being exploited in the wild.

**How severe is CVE-2026-77375?** Medium severity, with a CVSS score of 6.5, published 13 October 2026.

**Which products and versions are affected?** Drakkan SFTPGo 2.7.4 and earlier; github.com/drakkan/sftpgo (Go) SEMVER:introduced=0; github.com/drakkan/sftpgo/v2 (Go) <= 2.7.4, SEMVER:introduced=0,fixed=2.7.5.

**Is there a fix for CVE-2026-77375?** Yes. github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77375 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-77375?** Check whether you run Drakkan SFTPGo, github.com/drakkan/sftpgo (Go) or github.com/drakkan/sftpgo/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/drakkan/sftpgo/v2 (Go): upgrade to 2.7.5 or later

  ```sh
  go get github.com/drakkan/sftpgo/v2@v2.7.5
  ```


## Technical details

An improper validation of array index (CWE-129) in the SSH service's channel request handling allows an authenticated attacker to trigger an unhandled error that aborts the server process. The vulnerability requires prior SSH authentication and network access, and results in immediate unavailability of the service.

## Affected products

- drakkan SFTPGo 2.7.4 and earlier

## Identifiers

- CVE-2026-77375
- GHSA-q7pc-356p-hggc
- GO-2026-6792

## Timeline

- 2026-07-17: disclosed
- 2026-10-15: advisory

## References

- [https://api.github.com/users/arnimar](https://api.github.com/users/arnimar)

## Related threats

- [SFTPGo source-side file-pattern filter bypass during copy operations](https://junglewise.ai/threats/cve-2026-103028-sftpgo-source-side-file-pattern-filter-bypass-during-copy)
- [SFTPGo stored XSS via inline parameter in file downloads](https://junglewise.ai/threats/cve-2026-49245-sftpgo-stored-xss-via-inline-parameter-in-file-downloads)
- [SFTPGo path confinement bypass in public share ZIP download](https://junglewise.ai/threats/cve-2026-49244-sftpgo-path-confinement-bypass-in-public-share-zip-download)
- [GO-2026-4697 - SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo](https://junglewise.ai/threats/cve-2026-30915-sftpgo-improperly-sanitizes-placeholders-in-group-home)
- [SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy](https://junglewise.ai/threats/cve-2026-30914-sftpgo-vulnerable-to-path-traversal-and-permission-bypass-via)