An authenticated SSH user can send a malformed protocol message during the opening of a channel, causing SFTPGo to raise an unhandled error and terminate the server process. This results in a denial of service that affects all connected users until the service is restarted. The vulnerability is identified as incorrect calculation or resource exhaustion and does not compromise confidentiality or integrity.

SFTPGo versions prior to 2.7.5, including all releases in the 2.7.x series before that update, are affected. The issue exists in the open source, event‑driven file transfer application distributed by Drakkan.

The CVSS score of 6.5 classifies this as a moderate severity denial of service flaw. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated SSH user who can send the malformed request, so it is most likely to be exploited by insiders or compromised accounts. An attacker could deliberately crash the service, causing availability disruption for all users until the server is restarted.