SFTPGo CVE-2026-77375

Requires a valid authenticated SSH account on the SFTPGo server (PR:L) - the attacker must be able to log in before opening a channel and sending the malformed subsystem request, so exposure is highest on multi-tenant instances that provision accounts to untrusted or low-trust users. No special non-default configuration is needed and no user interaction is required; any version prior to 2.7.5 is affected. The practical blast radius is amplified because a single crafted message terminates the whole process, affecting all concurrently connected users until a manual restart. The authentication requirement is the primary limiting factor; single-tenant or trusted-operator deployments face materially lower risk.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5 MEDIUM) is internally consistent with the description: a network-reachable, low-complexity attack requiring low privileges (an existing authenticated SSH account) and no user interaction, producing a high availability impact with no confidentiality or integrity loss. The key limiting signal is PR:L - exploitation requires valid credentials, so this is not an unauthenticated internet-facing wormable flaw. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so exploitation probability signals are absent; based on available data this is no public exploit identified at time of analysis. However, the vendor security advisory (GHSA-q7pc-356p-hggc) and the fix commit are confirmed, and the committed test case (TestInvalidSubsystemRequest) demonstrates exactly how trivial the trigger is - a short or malformed subsystem payload - which lowers the practical barrier for anyone with an account to crash the service. Net: a real priority for multi-tenant SFTPGo deployments where untrusted users hold accounts (the crash affects all connected users until restart), but lower urgency for single-tenant or trusted-user installations. No CVSS/description conflict exists; the signals align.

An attacker who already holds valid SFTP credentials on a multi-tenant SFTPGo instance opens an SSH session channel and sends a malformed or truncated 'subsystem' request payload instead of a well-formed 'sftp' request. The unhandled parsing error terminates the entire server process, disconnecting every other logged-in user until an administrator restarts the service. No public exploit was identified, but the vendor's own regression test shows the exact malformed payloads (nil, empty, or short byte sequences) that trigger the crash.