Download Latest Version
v1.13.11 - maintenance release source code.zip (176.1 kB)
Get an email when there's a new version of sftp
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-07-12 | 1.1 kB | |
| v1.13.11 - maintenance release source code.tar.gz | 2026-07-12 | 126.8 kB | |
| v1.13.11 - maintenance release source code.zip | 2026-07-12 | 176.1 kB | |
| Totals: 3 Items | 304.0 kB | 1 | |
This release bounds an unchecked pre-allocation in the SSH_FILEXFER_ATTRS decoder, updates dependencies, and includes minor code cleanups.
Security/robustness
The attribute decoder (unmarshalFileStat) allocated the extended-attribute slice directly from the wire-supplied extended_count without bounding it against the available bytes. A peer could advertise a huge extended_count in a small packet and force a multi-gigabyte allocation up front, crashing the process with fatal error: out of memory before a single entry was parsed.
What's Changed
- fix: ineffective assignments by @alrs in https://github.com/pkg/sftp/pull/650
- refactor: replace interface{} with any (Go 1.18+) by @MD-Mushfiqur123 in https://github.com/pkg/sftp/pull/652
- fix: bound extended-count pre-allocation in unmarshalFileStat by @drakkan (co-authored by @mjbommar)
New Contributors
- @alrs made their first contribution in https://github.com/pkg/sftp/pull/650
- @MD-Mushfiqur123 made their first contribution in https://github.com/pkg/sftp/pull/652
Full Changelog: https://github.com/pkg/sftp/compare/v1.13.10...v1.13.11