Release Notes

TLDR - Quick Summary

What: SFTP Gateway version history and changelog

Latest: v3.9.0 - Feature release: connection limits, SSH compression, license auto-activation, unattended admin bootstrap, Spring Boot 4.1 / Java 21 / PostgreSQL 18

Key updates: OIDC login, Azure File Share support, LDAP authentication, CIS hardening support

Version 3.9.0

Summary

3.9.0 is the first minor release off develop since 3.8.1 (3.8.2 and 3.8.3 were hotfixes off the 3.8 line). The platform moves to Spring Boot 4.1 on Java 21 with PostgreSQL 18. New protection features bound concurrent connections globally, per IP, and per user, and the default failed-login IP ban drops from 5 hours to 5 minutes with full logging. The SSH layer gains zlib/zlib@openssh.com compression, a vendor-name algorithm alias mechanism, configurable within-tier algorithm ordering, and per-connection algorithm-negotiation audit logging. Licenses supplied via LICENSE_CONTENT now activate automatically at boot, and the first admin account can be created from environment variables so an unattended deployment needs no visit to the web UI. Configuration held in the database now propagates across a cluster. Security hardening includes SSH port-forwarding denial, JWT issuer allow-listing, OIDC redirect validation, and per-IdP admin-login enforcement. Major bug-fix clusters cover Azure File Share data integrity, Local Mount non-ASCII filenames, S3 endpoint URL handling, timestamp preservation, and authentication responsiveness.

A more technical copy of these notes ships in the distribution as docs/release-notes/v3.9.0.md.

New Features

• Concurrent connection limits. Connections can now be limited server-wide, per source IP, and per user. The per-user limit (default 50) is the default protection: it bounds a single runaway client without penalizing distinct users behind a shared NAT or proxy. The global and per-IP limits default to unlimited. (SFTPG-1647, SFTPG-5067)
• SSH compression. zlib and zlib@openssh.com compression now negotiate in both directions when the client requests it; uncompressed remains the default. (SFTPG-5683, SFTPG-5755)
• SSH algorithm aliases. An already-supported key exchange, cipher, MAC, or host-key algorithm can be advertised under additional names (for example, vendor-proprietary @ssh.com names), so legacy clients that only offer the proprietary name can connect using the standard implementation. Aliases are additive only and never appear in the admin UI. (SFTPG-5690)
• License auto-activation. A license supplied through the LICENSE_CONTENT environment variable now activates automatically at boot instead of waiting for an administrator to click Activate. Set license.auto-activate.enabled=false to keep the manual step. (SFTPG-5626)
• Initial admin user from environment variables. The first admin account can now be created at startup from ADMIN_USERNAME plus either ADMIN_PASSWORD or ADMIN_PASSWORD_FILE (a path, for mounted secrets), so an unattended or automated deployment no longer needs a human to visit the web UI before the instance is usable. The bootstrap runs before the SFTP and web listeners accept traffic and the create is atomic, so a clustered start cannot produce two initial admins. It applies only when no admin exists; set ADMIN_PASSWORD_FORCE_RESET=true to reset the configured admin's password on a later boot. The password is never written to the logs, and when no bootstrap values are set the setup wizard remains the way to create the first admin. (SFTPG-5530)
• Instance-profile credentials for non-default clouds. The "instance profile" credential option is now available for cloud connections beyond the deployment's default provider, supporting cross-cloud setups such as Google Cloud access federated through AWS IAM roles. (SFTPG-5490)

Improvements

• Platform upgrade: Spring Boot 4.1 on Java 21 (from Spring Boot 3.5, which reaches end of life in June 2026), with the framework dependency tree refreshed. VM images now launch the backend with a standard java -jar systemd unit. (SFTPG-5489, SFTPG-5638, SFTPG-5815)
• PostgreSQL 16 → 18 across all shipped deployment configurations (PostgreSQL 18 is supported through November 2030). See Upgrade Notes below for in-place upgrade guidance. (SFTPG-5617)
• Configurable SSH algorithm ordering. Algorithms are advertised strength-first (each category was already sorted by security strength). New optional per-category properties let an operator reorder algorithms within their security tier; an override can never promote a weak algorithm above a strong one. CUSTOM-level cipher and MAC selections now take effect (previously only key exchange and host keys were filtered). (SFTPG-5627)
• Algorithm negotiation audit logging. Each connection produces one INFO line in the sftp-audit log with the algorithms the client offered, the negotiated selection (or the failing category on a mismatch), the client identification string, and the source address — making "why can't this client connect?" diagnosable without verbose protocol logging. (SFTPG-5582)
• Option to ignore client-set timestamps (fewer duplicate S3 events). Persisting a client's "preserve timestamps" onto S3 requires a server-side copy of the object, and that copy emits an additional ObjectCreated:Copy event that can double-trigger event-driven workflows subscribed to the ObjectCreated wildcard. The new per-provider features.file-system.<provider>.ignore-client-set-times option keeps exactly one creation event per upload: the server accepts the client's timestamp calls, but objects keep their upload time and no metadata write or copy occurs. (SFTPG-5853)
• Configuration changes propagate across instances. The license and the SFTP login banner are stored in the database and are now picked up by every instance in a cluster, not only the one where the change was made. A background poller detects the change and refreshes the affected component in place, so activating a license or editing the banner on one instance no longer requires restarting the others for the change to take effect. A transient failure to reload a license is retried rather than leaving the instance on stale state. (SFTPG-5833)
• Containers run as a non-root user (UID 1000), pass the Kubernetes restricted pod security standard, and support OpenShift arbitrary UIDs and read-only root filesystems. In-container ports moved to non-privileged values (UI 8080/8443, SFTP 2244); externally mapped ports are unchanged. (SFTPG-5543)
• Smaller container images. Rebuilt image layering removes a duplicated copy of the backend jar and of the extracted admin-UI assets, shrinking the compressed backend image from 620 MB to 408 MB (-34%) and the admin-UI image from 33 MB to 17 MB (-47%). Runtime behavior, file ownership, and permissions are unchanged.
• Smaller VM images with fewer duplicate CVE findings. VM images no longer install Linux kernel header and profiling packages (perf, cpupower, bpftool, static kernel headers), which are build artifacts a running appliance never uses. This cuts image size and attack surface, and sharply reduces vulnerability-scan noise: the same kernel version was installed as several binary packages and each one was counted separately, so a single kernel advisory was reported many times over. The running kernel, the Azure Hyper-V guest daemons, and linux-libc-dev are retained. (SFTPG-5933)
• The "server is starting up" screen reloads automatically when the backend is ready, instead of asking the user to retry. (SFTPG-5589)
• Deleting an in-use cloud connection now returns a clear error naming the folders that still reference it. (SFTPG-5643)
• License product validation. A license issued for a different Thorn Technologies product is now rejected with "License is not for this product." Existing licenses are unaffected. (SFTPG-5681)
• License usage telemetry. Upload/download throughput is measured per license and reported daily to the licensing service, supporting consumption-based licensing. No customer-facing behavior change. (SFTPG-5110)

Security

• Backend security hardening (SFTPG-5731): SSH TCP port-forwarding is denied for SFTP users; license/JWT validation restricts issuer resolution to trusted issuers; and the OIDC post-login redirect is validated so the admin auth code cannot be sent to an untrusted URL. X-Forwarded-Host/X-Forwarded-Port are now honored behind a reverse proxy.
• Per-IdP OIDC admin login enforcement. An identity provider configured with admin authentication disabled can no longer be used to log in to the admin console. (SFTPG-5733)
• OpenAPI spec requires authentication. The OpenAPI spec at /v3/api-docs was served without authentication, disclosing the full API schema through the UI proxy. It now requires an authenticated admin; API tooling can still fetch the spec with an admin token, and the new features.api.public-api-docs property (default false) restores anonymous access for build/dev tooling. (SFTPG-5922)
• Netty 4.2.16.Final — the Spring Boot 4.1 dependency tree ships the Netty 4.2 line, superseding the interim 4.1.135 bump; the HIGH CVEs that bump cleared (CVE-2026-44249, CVE-2026-45416, CVE-2026-45674) remain resolved. (SFTPG-5772) A further bump from 4.2.15.Final clears five more HIGH advisories — denial of service via SPDY SETTINGS frame processing (CVE-2026-55831), SPDY header decompression amplification (CVE-2026-55833), memory exhaustion in the SPDY-to-HTTP codec (CVE-2026-56745), an HTTP/3 codec advisory (CVE-2026-56816) and an infinite loop in the bzip2 decoder (CVE-2026-59901) — along with six MEDIUM advisories: a null-origin request bypass (CVE-2026-56746), WebSocket protocol version confusion (CVE-2026-59898), an HTTP decompression bomb (CVE-2026-59899), improper HTTP/2 header neutralization (CVE-2026-59900), CRLF injection via a multipart filename (CVE-2026-59921) and a DNS record decoder memory leak (GHSA-mfg7-5gfp-c4w3). (SFTPG-5945)
• PostgreSQL JDBC 42.7.12 — clears a man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade (CVE-2026-54291, HIGH) in the SCRAM client used to authenticate to the database. (SFTPG-5945)
• Jackson 3.2.1 — clears an async-parser maxNumberLength bypass via chunked digit accumulation (GHSA-r7wm-3cxj-wff9, HIGH) in jackson-core, and @JsonView being bypassed for @JsonUnwrapped container properties during deserialization (CVE-2026-59889, MEDIUM) in jackson-databind. (SFTPG-5945)
• azure-resourcemanager 2.62.0 — resolves azure-security-keyvault-keys ≥ 4.10.6 (CVE-2026-33117), replacing the pin shipped in 3.8.3. (SFTPG-5751)
• jackson-databind 2.21.5 — clears CVE-2026-54515 (MEDIUM) in the Jackson 2 copy the cloud SDKs pull in transitively, independently of the application's own Jackson 3 tree covered above.
• logback 1.5.35 — clears CVE-2026-10532 (LOW, deserialization of untrusted data) in logback-core; logback-classic moves in lockstep.

Bug Fixes

Connection protection

• Heap exhaustion under high reconnect load. A client that repeatedly opened connections without closing them could exhaust server memory and crash the SFTP service. Connection growth is now bounded by the new connection limits, and a disconnect no longer closes the shared GCP storage client used by other live connections. (SFTPG-5780)
• Silent 5-hour IP ban after failed logins. Repeated failed authentications banned the source IP for 5 hours with no log entry — one misconfigured client behind a NAT could lock out an entire site with no visible cause. The default ban is now 5 minutes, and bans and refused connections are logged as warnings. (SFTPG-5850)

Authentication

• Unknown username hung the client. A password login for a nonexistent user received no response, leaving clients such as FileZilla to hang until their timeout. Unknown users now fail promptly, indistinguishably from a wrong password. (SFTPG-5756)
• Unreachable LDAP/AD server stalled password logins. Directory binds had no timeout, so an unreachable server blocked each login attempt for over a minute and could stall all authentication. Binds now time out after 5 seconds (configurable). (SFTPG-5757)

Azure File Share data integrity

• Append mode could destroy data — appending could truncate and recreate the file, destroying existing content. Appends now resize in place without data loss. (SFTPG-5584)
• Uploads landed as 0-byte files — content was written and then truncated. (SFTPG-5818)
• Files uploaded during a session listed as 0 bytes until the client reconnected (the data itself was intact). (SFTPG-5851)
• Overwriting a file with a smaller one left stale trailing content from the original. (SFTPG-5826)

Timestamps

• Preserved timestamps were lost on upload. For clients that preserve timestamps by setting them while the upload is still in progress (FileZilla's behavior), the preserved time was replaced by the upload time on Google Cloud Storage, Azure Blob, and Azure File Share, and on S3 for multipart (large-file) uploads. The client's timestamps are now applied when the upload completes. On S3, applying a preserved timestamp to a multipart upload produces an additional ObjectCreated:Copy event; workflows that require exactly one creation event per upload should subscribe to ObjectCreated:Put and ObjectCreated:CompleteMultipartUpload instead of the ObjectCreated wildcard, or use the ignore-client-set-times improvement above. (SFTPG-5852)

Local Mount

• Non-ASCII filenames were corrupted. Files with accented or CJK characters in their names uploaded and listed correctly but could not be downloaded, renamed, or deleted. The Local File System backend was reimplemented on java.nio, fixing filename handling; file attributes and timestamps are likewise now written directly through java.nio. (SFTPG-5782)
• Listing a new user's home folder failed before anything had been written to it, instead of showing an empty directory. (SFTPG-5863)
• First launch logged a bogus "Unsupported cloud provider lfs" error and stalled several seconds on an unnecessary AWS metadata call. (SFTPG-5837)

AWS S3

• China, dualstack, and VPC endpoint URLs were rejected in the S3 base prefix, and an invalid URL was accepted at input time only to fail later with an opaque error. These AWS endpoint forms are now accepted, URLs are validated when the connection is saved, a regional URL fills in the connection's region automatically, and non-AWS endpoints are rejected with a clear message. (SFTPG-5871)
• An S3 error without an error code caused a NullPointerException that hid the real error from the client. (SFTPG-5774)

Licensing

• A transient license read at boot showed "No License" on HA nodes until an administrator manually reloaded. Boot-time loading now retries, and the logs distinguish "no license configured" from "license read failed." (SFTPG-5694)
• The license-activation rate limiter miscounted under concurrent access from a single IP. (SFTPG-5819)

Other

• systemd-notify skip was logged at ERROR on container boot. Containers have no systemd, so every boot logged the graceful skip of the readiness notification at ERROR, misleading log-based alerting. It is now logged at INFO. (SFTPG-5923)
• Admin UI web fonts were blocked by the page's own security policy. The admin UI ships a strict Content-Security-Policy that allows fonts only from the application itself, but the build inlined the eight smallest Roboto subset files directly into the stylesheet. Browsers blocked all eight and rendered fallback fonts for those character ranges, logging a policy violation for each. Fonts are now always emitted as separate files, which the policy permits; the policy itself remains strict. (SFTPG-5530)
• Creating a new file no longer truncates an existing file at the same path; it returns an error instead. (SFTPG-4751)
• The Azure connection string was cleared when toggling the hierarchical-namespace checkbox in the cloud connection form. (SFTPG-4809)
• Switching a cloud connection to unique credentials produced an unhandled error. (SFTPG-5000)
• The AWS single-instance Terraform template reported the wrong public IP (the pre-Elastic-IP address) in its hostname output. (SFTPG-5778)
• The Azure single-instance Terraform template failed on current provider versions. (SFTPG-5779)

Upgrade Notes

• PostgreSQL 16 → 18: for an in-place pg_upgrade, pass --no-data-checksums if the old cluster was initialized without checksums (PostgreSQL 18 enables them by default), and re-hash any MD5-password roles as SCRAM.
• Containers: images now run as UID 1000 with in-container ports 8080/8443 (UI) and 2244 (SFTP). Update Kubernetes manifests or compose files that assumed root or privileged ports; externally mapped ports are unchanged.
• VM images: the backend systemd unit now launches with java -jar; review any custom drop-ins that patched the old launch script.
• Internal configuration table: the upgrade adds a uniqueness constraint on the key column of the internal properties table, and first deletes rows that no code path can reach — those whose application, profile, or label columns hold anything other than the single combination the product reads and writes. A database created before a 2022 spelling correction to the application name can still hold such rows, orphaned ever since. No reachable configuration is affected, and no action is required. (SFTPG-5833)

New Application Properties

Initial admin bootstrap (environment variables)

Set as environment variables rather than in application.properties — these are not properties-file settings, and they apply to every deployment form. In containers, set them in your Docker Compose file or Kubernetes manifest, using ADMIN_PASSWORD_FILE with a mounted secret to keep the password itself out of the manifest. On VM deployments, set them in /opt/sftpgw/launch_config.env (root-only, mode 0600). All four are optional; when neither a username nor a password source is set, the setup wizard is used instead.

Variable	Default	Description
ADMIN_USERNAME	(unset)	Username for the initial admin. Follows the same username rules as the setup wizard.
ADMIN_PASSWORD	(unset)	Password for the initial admin. Must satisfy the configured password policy.
ADMIN_PASSWORD_FILE	(unset)	Path to a file containing the password, for mounted secrets. Used when ADMIN_PASSWORD is not set.
ADMIN_PASSWORD_FORCE_RESET	false	On a later boot, reset the configured admin's password to the supplied value. Ignored when no bootstrap credentials are set.

Admin API (features.api.*)

Property	Default	Description
public-api-docs	false	Serve the OpenAPI spec at /v3/api-docs without authentication. Off by default; the build-time OpenAPI export enables it for its own run.

SFTP connection limits (sftp.*)

Property	Default	Description
max-connections	-1	Maximum concurrent SFTP connections server-wide. -1 = unlimited.
max-connections-per-ip	-1	Maximum concurrent connections from a single source IP. -1 = unlimited.
max-connections-per-user	50	Maximum concurrent connections per SFTP user.

SSH algorithm aliases (sftp.algorithm-aliases[n].*)

Property	Default	Description
canonical	(unset)	An enabled key exchange, cipher, MAC, or rsa-sha2-256 host-key algorithm to advertise under additional names.
aliases	(unset)	Comma-separated additional names to advertise for the canonical algorithm.

License auto-activation and licensing service (license.*, lars.*)

Property	Default	Description
license.auto-activate.enabled	true	Automatically activate an unbound license supplied via LICENSE_CONTENT at boot.
license.auto-activate.loser-wait	10s	How long a node that lost the activation race waits for the winner's result.
license.auto-activate.loser-poll-step	500ms	Poll interval while waiting for the winner's result.
lars.base-url	https://licensing.thorntech.com	Licensing/telemetry service base URL.
lars.connect-timeout	5s	Connect timeout for licensing service calls.
lars.license-read-timeout	7s	Read timeout for the boot-time license activation call.
lars.telemetry-read-timeout	30s	Read timeout for telemetry report submissions.

Temporary IP banning (features.sftp-subsystem.temporary-ip-banning-policy.*)

Property	Default	Description
failed-authentication-count-before-ip-banning	15	Failed authentications within the threshold window before a source IP is temporarily banned.
failed-authentication-threshold-duration-minutes	5	Window for counting failed authentications.
ip-banning-duration-minutes	5	Ban duration (was effectively 300 minutes in prior releases). Bans are held in memory; a restart clears them.

SSH algorithm ordering (features.sftp-subsystem.*.preferred-order)

Property	Default	Description
kex.preferred-order	(unset)	Comma-separated key exchange algorithms to move to the front of their security tier (CUSTOM level only).
host-key.preferred-order	(unset)	Same, for host-key algorithms.
cipher.preferred-order	(unset)	Same, for ciphers.
mac.preferred-order	(unset)	Same, for MACs.

LDAP / Active Directory timeouts (features.sftp-subsystem.ldap.*)

Property	Default	Description
connect-timeout-ms	5000	Connect timeout for LDAP/AD binds during SFTP password authentication.
read-timeout-ms	5000	Read timeout for LDAP/AD binds.

Per-provider timestamp handling (features.file-system.<provider>.*)

Property	Default	Description
ignore-client-set-times	false	Ignore client-set timestamps (SETSTAT/FSETSTAT) instead of persisting them, per provider (aws-s3, gcp, azure, azure-file-share). The object keeps its upload time and no metadata write occurs.

Audit logging (features.audit.*)

Property	Default	Description
log-algorithm-negotiation	true	Log one INFO line per connection with client-offered and negotiated SSH algorithms.

Reverse proxy headers (server.tomcat.remoteip.*)

Property	Default	Description
host-header	X-Forwarded-Host	Header used to resolve the external host for request-derived URLs behind a proxy.
port-header	X-Forwarded-Port	Header used to resolve the external port.

Version 3.8.3

Summary

This is a security-driven hotfix off the 3.8.2 line. It bumps Tomcat, Spring Boot, Netty, PostgreSQL JDBC, and Bouncy Castle to clear 11 HIGH-severity dependency CVEs, switches the Ubuntu image bake from apt-get upgrade to apt-get dist-upgrade so kernel patches for CVE-2026-23112 and CVE-2026-31431 (the latter on the CISA KEV list) actually land on rebake, and fixes two SFTP bugs: a v3 directory-listing NullPointerException on certain S3-backed prefixes (SFTPG-5686) and uploads to S3 and Alibaba failing with "Error while copying the S3 object" when the client preserves timestamps (SFTPG-5750).

Security

Java dependencies — None of the Java-dependency CVEs below was actively exploitable in our deployment based on a per-CVE review of code paths (nginx terminates HTTP/2 at the edge and proxies HTTP/1.1 to Tomcat; we use JWT, not DIGEST; Spring Security is programmatic without web.xml multi-method constraints; Netty is used only as a client to AWS endpoints; LDAPStoreHelper is not on our call path). The bumps clear the scanner findings regardless.

• CVE-2026-41293 (9.8 Critical) — Tomcat HTTP/2 HPACK header validation. Fixed by Tomcat 10.1.54 → 10.1.55.
• CVE-2026-43512 (9.8 Critical) — Tomcat DIGEST authenticator. Fixed by Tomcat 10.1.54 → 10.1.55.
• CVE-2026-43515 (9.1 Critical) — Tomcat <web-resource-collection> HTTP-method enforcement. Fixed by Tomcat 10.1.54 → 10.1.55.
• CVE-2026-40973 (High) — Spring Boot. Fixed by Spring Boot 3.5.13 → 3.5.14.
• CVE-2026-42579 (High) — netty-codec-dns RFC 1035 validation bypass. Fixed by Netty codecs 4.1.128.Final → 4.1.133.Final.
• CVE-2026-42581 (High) — netty-codec-http HTTP/1.0 request smuggling. Fixed by Netty codecs 4.1.128.Final → 4.1.133.Final.
• CVE-2026-42583 (High) — netty-codec input validation. Fixed by Netty codecs 4.1.128.Final → 4.1.133.Final.
• CVE-2026-42584 (High) — HttpClientCodec response desync on pipelined 1xx. Fixed by Netty codecs 4.1.128.Final → 4.1.133.Final.
• CVE-2026-42587 (High) — netty-codec-http / -http2. Fixed by Netty codecs 4.1.128.Final → 4.1.133.Final.
• CVE-2026-42198 (High) — PostgreSQL JDBC client-side DoS via malicious SCRAM-SHA-256. Fixed by pgJDBC 42.7.7 → 42.7.11.
• CVE-2026-0636 (6.9 Medium) — Bouncy Castle LDAPStoreHelper LDAP injection. Fixed by Bouncy Castle 1.81 → 1.84.

Linux kernel

• CVE-2026-23112 (High) — Linux kernel nvmet-tcp PDU walk past sg_cnt — remote DoS on NVMe-oF TCP target. Fixed by the distro kernel patch pulled by apt-get dist-upgrade / yum update during the Packer bake.
• CVE-2026-31431 (7.8 High, CISA KEV) — Linux kernel algif_aead local privilege escalation via AF_ALG. Fixed by the distro kernel patch pulled by apt-get dist-upgrade / yum update during the Packer bake.

Image bake

• Ubuntu bake now uses apt-get dist-upgrade instead of apt-get upgrade. Plain upgrade holds back kernel metapackage transitions on Ubuntu (a linux-image-generic retarget to a new versioned linux-image-X.Y.Z package counts as a new install, which upgrade won't perform). The Ubuntu-flavored Azure and GCP images were therefore not receiving kernel CVE patches even though Ubuntu shipped them. Switching to dist-upgrade with --allow-change-held-packages lets the rebake roll forward to the patched kernel. Verified post-build on a fresh GCP instance: uname -r returns 6.17.0-1016-gcp, matching the Ubuntu security tracker's fixed-version target for both CVE-2026-23112 and CVE-2026-31431.

• Amazon Linux bake unchanged. The existing yum update -y step already pulled kernel patches; no yum analogue of the upgrade vs dist-upgrade hold-back applies.

• Docker Hub container images share the host kernel. Container kernel CVE clearance is handled by the base-image refresh on the Docker Hub publish step.

Bug Fixes

• SFTP upload to S3/Alibaba fails when the client preserves timestamps — Clients that preserve modification times (for example FileZilla with "Preserve timestamps of transferred files") send an FSETSTAT on the open file handle before close(). With skipZeroBytePlaceholder enabled (the shipped mode), the file exists only virtually at that point — the actual putObject happens on close() — so CloudFile.setAttributes saw the file as existing and ran a server-side metadata self-copy against a key the cloud did not have yet. That copy failed with NoSuchKey and the server returned SSH_FX_FAILURE ("Error while copying the S3 object") to the client, after the bytes had already transferred. The metadata self-copy now runs only when the object physically exists in cloud; for an in-flight upload the attributes are merged into the pending upload and written on commit, so the client's timestamp is still preserved. The shared fix in CloudFile.setAttributes covers S3, Alibaba, and Azure (GCP already no-ops when the object is absent; the local file system is unaffected). The underlying cloud error code and message are now surfaced in the SFTP failure (instead of a generic string) for both S3 and Alibaba, so the real cause is visible to clients and operators. (SFTPG-5750)

• SFTP v3 directory-listing NPE on certain S3 objects — When an S3 object's user metadata contained an mtime key with an empty or non-numeric value, CloudFileAttributesService.convertToSftpFileAttributes returned a SftpgwFileAttributes with accessed-time set but modified-time null. Maverick's SFTP v3 toByteArray serializes atime and mtime as a flag-gated pair without a null guard, so the response packet construction NPE'd at SftpFileAttributes.java:1063 and dropped the SSH channel. FileZilla, WinSCP, and the OpenSSH sftp client all default to v3, so any client listing the affected prefix was hit. Restored the unconditional time-metadata safety net in convertToSftpFileAttributes, plus added a mirror-then-leave-empty fallback that propagates any populated time to its siblings while leaving fully-empty state untouched (no churning "now" on every listing). Five new regression tests cover the v3/v6 serialization combinatorial and each branch of the mirror chain. (SFTPG-5686)

Dependency Updates

• Apache Tomcat: 10.1.54 → 10.1.55
• Spring Boot: 3.5.13 → 3.5.14
• Netty codecs (codec, codec-dns, codec-http, codec-http2): constraint-pinned at 4.1.133.Final
• PostgreSQL JDBC: 42.7.7 → 42.7.11
• Bouncy Castle (bcprov-jdk18on, bcpkix-jdk18on): 1.81 → 1.84

Version 3.8.2

Summary

This release fixes a critical compatibility issue with FileZilla 3.70.0, adds post-quantum key exchange support, migrates from AWS SDK v1 to v2, and addresses multiple security vulnerabilities in embedded Tomcat and Spring Framework.

New Features

• Post-quantum key exchange — Added hybrid post-quantum key exchange algorithms via Maverick Synergy 3.0.31, providing protection against future quantum computing threats:

  • mlkem768x25519-sha256 — ML-KEM (Kyber-768) + X25519, the NIST-standardized post-quantum algorithm

  • sntrup761x25519-sha512 — Streamlined NTRU Prime + X25519

  • sntrup761x25519-sha512@openssh.com — OpenSSH variant

• Content Security Policy — Added CSP and Referrer-Policy headers to the admin UI

Improvements

• AWS SDK v2 migration — Removed AWS SDK v1 dependencies, replaced with SDK v2 for S3 and KMS operations

• JVM tuning — Pre-allocate 30% of max heap to reduce GC pressure during file transfers

Security

• CVE-2026-34487, CVE-2026-34483, CVE-2026-34486, CVE-2026-34500 — Pinned Tomcat to 10.1.54 to address information disclosure and encryption bypass vulnerabilities

• CVE-2026-29145 — Upgraded embedded Apache Tomcat to address OCSP certificate revocation check bypass

• CVE-2026-22737 and CVE-2026-22735 — Upgraded Spring Framework to 6.2.17 via Spring Boot 3.5.13

Bug Fixes

• FileZilla 3.70.0 compatibility — FileZilla 3.70.0 sends window=0xFFFFFFFF (the maximum unsigned 32-bit integer) in its SSH channel open message. The Maverick Synergy SSH library incorrectly interpreted this as a signed integer value of -1, causing an IllegalArgumentException when attempting to send the SFTP initialization response. The fix reads the window size as an unsigned integer, matching the SSH protocol specification (RFC 4254). (Groove #11334)

• createNewFile() behavior — Fixed createNewFile() to return false when the file already exists instead of silently succeeding

• S3Uri key handling — Fixed S3Uri key handling with null region guard

• KMS client resource leak — Close KmsClient after use to prevent resource leaks

Dependency Updates

• Maverick Synergy SSH library: 3.0.26-SNAPSHOT → 3.0.31.1
• BouncyCastle: upgraded to 1.81
• Spring Boot: 3.5.11 → 3.5.13
• Apache Tomcat: 10.1.53 → 10.1.54 (pinned)
• AWS SDK: v1 removed, v2 (2.41.7)
• Maverick Synergy license renewed

Version 3.8.1

Summary

This patch release focuses on zero-byte file upload reliability, S3 connection pool stability under concurrent load, security hardening, and new configurable timeouts for cloud storage operations. It also adds per-user API rate limiting, Content Security Policy headers, and a new upload-init audit event for better upload traceability.

Improvements

• Connection thread optimizations and configurable timeouts — Improved thread pool and timeout handling for SFTP connections, increasing stability under high concurrency. The S3 async client now exposes a full set of tunable HTTP connection pool and timeout properties (see New Application Properties below). The default multipart upload part size has been reduced from ~117 MB to 8 MB to improve connection cycling and backpressure under concurrent load.

• Per-user API rate limiting — The admin REST API now enforces per-user rate limiting using a fixed-window algorithm. The default limit is 200 requests per second per authenticated user. When exceeded, the API returns HTTP 429 with a Retry-After header. Set features.api.rate-limit-per-second to 0 to disable.

• Configurable CORS origin pattern — The CORS allowed origin pattern for the admin API is now configurable. The default * supports self-hosted appliances accessed via any hostname. Restrict it for security-conscious deployments using features.api.cors-allowed-origin-pattern.

• Content Security Policy and Referrer-Policy headers — The admin UI and landing page now include Content Security Policy meta tags that restrict script and frame sources, preventing XSS injection and clickjacking. The API also sets an explicit Referrer-Policy: strict-origin-when-cross-origin header for defense-in-depth.

• Cloud client caching and lifecycle management — Storage clients for GCP, Azure Blob, Azure File Share, and Alibaba Cloud are now cached and reused across SFTP operations, reducing connection setup overhead. All cached clients are properly closed on application shutdown or credential refresh.

• Auto-upgrade cloud-sql-proxy within major version — The cloud-sql-proxy binary installed on GCP images is now auto-upgraded to the latest patch within its current major version during AMI setup.

• Upload-init SFTP audit event — A new upload-init event is now logged in the SFTP audit log whenever a file upload begins, providing better end-to-end upload traceability.

• Resolved cloud path in folder edit form — The folder edit form in the admin UI now consistently displays the fully resolved cloud path, matching what the SFTP server uses at runtime.

• AWS KMS key validation during Test Connection — The Test Connection action for AWS S3 cloud connections now validates the configured KMS key when SSE-KMS encryption is selected. The test verifies the key exists, is enabled, and can be used for both encryption and decryption. Invalid, disabled, or inaccessible keys are reported as a validation error on the encryptionId field.

• Disabled admin session enforcement — Disabling an admin account now immediately rejects all API requests authenticated with that account's existing JWT token. Previously, a disabled admin's JWT remained valid until it expired (up to 8 hours). A new server-side filter checks the account's enabled status on every authenticated request and returns 401 Unauthorized if the account has been disabled.

Security

• Sanitized exception handler error messages — API error responses no longer expose raw exception messages that could leak database schema details, file paths, or cloud provider internals. Generic messages are returned to clients while full details are logged server-side.

• Updated UI dependencies — Resolved 36 known vulnerabilities in the admin UI by updating axios, lodash, jspdf, dompurify, canvg, and @babel/runtime to patched versions.

Bug Fixes

• Zero-byte file upload fixes

  • 0-byte files not persisting to cloud — Zero-byte files uploaded via SFTP were silently dropped and never written to cloud storage. They are now correctly persisted.

  • Missing upload-complete event for 0-byte files — A synthetic upload-complete event is now fired for zero-byte uploads so downstream event processors receive the full lifecycle.

  • Truncate/complete lifecycle for zero-byte overwrites — The truncate-then-complete sequence has been corrected to handle zero-byte overwrite scenarios properly, preventing complete() from replacing existing cloud objects with empty ones.

• Event tracking fixes

  • Duplicate BlobCreated events on file overwrite — Cloud truncation is now deferred to eliminate spurious duplicate events (e.g., S3 BlobCreated) when overwriting an existing file.

  • Stale correlation ID on same-name re-uploads — Re-uploading a file with the same name no longer reuses the previous correlation ID, ensuring accurate event tracking across upload cycles.

• S3 connection pool exhaustion during backup import — Bulk backup imports could exhaust the S3 HTTP connection pool, causing the import to hang. The new max-inflight-upload-parts throttle and reduced part size prevent pool starvation under sustained write load.

• Resource leak fixes

  • Unclosed file streams in host key and license I/O — File streams for SSH host key and license key pair operations are now properly closed via try-with-resources.

  • HttpURLConnection leak in Azure IMDS queries — The connection to the Azure Instance Metadata Service is now disconnected after each query.

  • Unclosed BufferedReader in backup import — The reader for backup artifact files is now wrapped in try-with-resources.

  • GCP Storage client leak on test connection — Uncached GCP Storage clients created for unsaved connections are now closed after use.

  • Multipart upload futures not cancelled on abort — Both S3 and Alibaba multipart upload abort paths now cancel and clear pending upload futures, preventing leaked HTTP connections.

• Alibaba Cloud fixes

  • OOM during large file uploads — Fixed out-of-memory errors caused by fromBytes() doubling memory per part; switched to fromInputStream().

  • Multipart upload part size — Reduced from 100 MB to 8 MB for consistency with S3 and to reduce memory pressure.

  • Upload backpressure — Added configurable backpressure limiting the number of in-flight upload parts, preventing unbounded memory growth.

  • Credential cache thread safety — Replaced HashMap with ConcurrentHashMap and added proper shutdown for cached credential providers.

• S3 multipart copy abort error logging — Multipart copy operations now abort on failure and log errors at WARN level, distinguishing between connection errors and other exceptions.

• Azure test connection validation — The test connection flow now validates Azure container and file share names before attempting the connection.

• Fixed OIDC login failure with Okta and other identity providers — Resolved an issue where OIDC single sign-on login failed with a deserialization error when the identity provider included non-standard numeric claims in the ID token.

• Cloud connection base prefix whitespace not trimmed — Leading and trailing whitespace in the cloud connection base prefix (e.g., a trailing space in an S3 path pasted from a browser) was silently preserved, causing file operations to target an incorrect storage path. The base prefix is now stripped on creation for all cloud provider types.

• Delete event audit log missing full storage location — The SFTP_FILE_DELETED audit log event was missing the STORAGE_LOCATION field that upload and download events include. Delete events now show the fully resolved cloud storage path (e.g., s3://bucket/path/file.txt), matching the format used by other file operation events.

• Frontend console error on page load — The admin UI logged a 404 console error on every page load while checking whether first-time setup is needed. The check now handles the expected 404 response without logging an error.

New Application Properties

Admin API (features.api.*)

Property	Default	Description
cors-allowed-origin-pattern	*	CORS allowed origin pattern. Restrict to a specific origin (e.g., https://sftp.example.com) for security-conscious deployments.
rate-limit-per-second	200	Maximum API requests per second per authenticated user. Set to 0 to disable rate limiting.

AWS S3 (features.file-system.aws-s3.*)

Property	Default	Description
max-inflight-upload-parts	4	Maximum multipart upload parts in flight concurrently before the writer thread blocks. Limits connection pool consumption during large file uploads.
http-max-concurrency	500	Maximum concurrent HTTP connections in the S3 async client pool.
metadata-timeout-seconds	30	Timeout for S3 metadata operations (HEAD, list, etc.).
data-timeout-seconds	300	Timeout for S3 data transfer operations (GET, PUT).
http-write-timeout-seconds	0	HTTP socket write timeout. 0 disables.
http-read-timeout-seconds	0	HTTP socket read timeout. 0 disables.
http-connection-acquisition-timeout-seconds	120	Maximum time to wait when acquiring a connection from the pool.
http-connection-time-to-live-seconds	300	Maximum lifetime of an HTTP connection before it is replaced.
http-connection-timeout-seconds	300	Timeout for establishing a new HTTP connection.
http-connection-max-idle-time-seconds	300	Maximum idle time before an HTTP connection is closed.

Changed default: max-simple-upload-size-bytes reduced from ~117 MB to 8 MB. This property now controls both the simple upload threshold and the multipart part size. Smaller values improve connection cycling and backpressure under concurrent load.

Azure (features.file-system.azure.*)

Property	Default	Description
http-write-timeout-seconds	0	HTTP socket write timeout. 0 disables.
http-read-timeout-seconds	0	HTTP socket read timeout. 0 disables.
credential-max-retry	1	Maximum retry attempts for credential acquisition.
credential-retry-timeout-seconds	5	Timeout per credential retry attempt.
storage-retry-count	5	Number of retries for storage operations.

Alibaba Cloud (features.file-system.alibaba.*)

Property	Default	Description
response-timeout-seconds	600	Timeout for Alibaba Cloud OSS API responses.
max-simple-upload-size-bytes	8388608 (8 MB)	Controls both the simple upload threshold and the multipart part size. Files smaller than this use a single PUT request. Files larger use multipart upload with parts of this size. Matches the AWS S3 default.
max-inflight-upload-parts	4	Maximum multipart upload parts in flight concurrently before the writer thread blocks.

Version 3.8.0

Summary

SFTP Gateway v3.8.0 marks the general release of the backend and UI container images and the end of 0-byte uploads when SFTP clients make a "createFile" call before uploading a file's contents with "put". The container images are built using Docker hardened images to constrict surface attack area and eliminate base image CVEs. The end of 0-byte uploads means simpler cloud storage event handling in serverless functions. In addition to these product changes, code dependencies and OS packages are updated to resolve CVEs.

New Features

• SFTP Gateway Container Image is now generally available, with a free 30-day trial via in-app registration:
  • thorntech/sftpgateway-backend
  • thorntech/sftpgateway-admin-ui
• Adds tracking metadata configuration via application properties to add metadata to each upload with a correlation ID, username, and remote address (IP address of uploader), helping track the flow of a file through backend processing after upload. Use these application properties to enable tracking:
  • features.file-system.metadata.enable-correlation-id=true
  • features.file-system.metadata.enable-username=true
  • features.file-system.metadata.enable-remote-address=true

Improvements to existing features

• Uploading a file via SFTP no longer triggers a cloud storage event for a 0-byte file, eliminating the need to filter for 0-byte files in triggered functions (e.g., AWS Lambdas). Instead of writing the 0-byte file to cloud storage, file creation happens in a session-persistent virtual registry. To restore the creation of the 0-byte file in cloud storage, set this application property:
  • features.file-system.skip-zero-byte-placeholder=false
• Enhances logging of errors when writing to or reading from cloud storage to make debugging failed SFTP operations easier.
• Supports import of Linux user encrypted shadow passwords to import Linux users from OpenSSH servers, including SFTP Gateway v1.

Security Updates

CVEs Resolved

• CVE-2025-55163 - Netty network transport vulnerability
• CVE-2026-22029 - React Router XSS vulnerability
• CVE-2025-53864 - DoS via nested JSON
• CVE-2025-48924 - Apache Commons Lang uncontrolled recursion vulnerability

Note: These CVEs do not necessarily present vulnerabilities with normal usage of SFTP Gateway. Administration Web Interface access should be restricted to specific IPs via Security Groups or firewalls to avoid possible XSS attacks.

Dependency Updates

• Spring Boot: 3.5.7 → 3.5.9
• nimbus-jose-jwt: 9.37.4 → 10.0.2
• AWS SDK (v1): 1.12.792 → 1.12.797
• AWS SDK (v2): 2.36.2 → 2.41.7
• Azure Storage Blob: 12.30.0 → 12.31.2
• Azure Identity: 1.15.4 → 1.18.1
• Azure Resource Manager: 2.48.0 → 2.54.0
• Google Cloud libraries-bom: 25.2.0 → 26.73.0
• Apache commons-lang3: 3.17.0 → 3.18.0

Bug Fixes

• Prevents infinite recursion causing excessive logs when a user has a configured IP Allow List.
• Sets severity level correctly when ingesting logs into Google Cloud Logs.

Version 3.7.4

Summary

SFTP Gateway v3.7.4 includes a new Cloud Connection type to connect to locally mounted storage volumes as well as an increase in throughput when uploading files. It also includes security updates by migrating the Ubuntu base image to a new version (24.04), upgrading backend and frontend libraries, and fixing an issue where the public key encryption algorithms were not limited by the selection of available encryption algorithms. This update also improves the usefulness of the audit log trail by adding a Correlation ID and Success status to appropriate log entries.

New Features

• Adds Local Mount Cloud Connection to allow specifying local directory paths as a file storage destination.
• Adds a Correlation ID to the audit log when a file starts and completes uploads or downloads via SFTP, helping with end-to-end traceability.

Improvements to existing features

• Improves file upload speed by implementing batch write methods and more efficient memory buffering.
• Simplifies and corrects application property (features.file-system.aws-s3.max-simple-upload-size-bytes) to specify the size that an AWS S3 upload uses a multipart upload rather than a simple upload.
• Updates Ubuntu base images from v22.04 to v24.04.
• Shows success status on audit log entries to indicate if the logged operation succeeded.
• Upgrades backend libraries to address CVE-2025-55754 to prevent control characters in tomcat log files causing issues in Windows.
• Specifies retry in Cloud Storage SDKs to improve resiliency of Cloud Connections especially during api throttling events.
• Allows configuration of GCP Cloud Logging receiver names.

Bug fixes

• Prevents syslogs from overflowing disk by specifying a size limit in logrotate config.
• Fixes a problem where Public Key encryption algorithms were not being limited by the selected algorithms on the Settings page.

Version 3.7.2

Summary

This release contains improvements for Azure Cloud Connections, upgrades dependencies to pass CVE scans, and a fix for a v3.7.1 bug when resolving cloud connections on folders.

Improvements to existing features

• Uses Last Modified Date provided by Azure HNS Storage for directories.
• Shows error message when Login fails via OIDC.

Bug fixes

• Fixes v3.7.1 bug where changing a folder's cloud connection did not immediately apply the change for when a user logs in via SFTP.
• Fixes bug that prevented numbers in Azure Cloud Connection containers.
• Corrects encoding for Azure Cloud Connection special characters in container directory.
• Updates Apache commons VFS library to address CVE-2025-30474 and CVE-2025-27553.
• Updates Apache embedded Tomcat library address CVE-2025-31650 and CVE-2025-31651.

Version 3.007.01

New Features

• Added backend health check endpoint that can confirm if the SFTP service is healthy (/backend/actuator/health).
  • Deployment templates have been updated to use this healthcheck endpoint.
• The launch_config.env file, especially used during HA deployments, has newly supported variables to better support deployments into existing environments/using existing databases.
  • Documentation for the variable settings: Configuring sftpgatewaysetup via launch_config.env

Feature updates

• The application log messages now include the Admin username who made the change when an entity is deleted, created, or updated.
• Identity Providers can be configured to restrict logins to users that already exist in SFTP Gateway, restricting access and preventing the auto-provisioning of users.
• The resolved cloud storage location path is shown on the header row of the folders table.

Bug fixes

• When sftp clients connect at the same time, there was a chance that a client could get a blank encryption list response from the server, causing the connection to error out. This bug has been fixed so the encryption algorithms will not present as blank.
• Database passwords containing single quotes are now supported.

Version 3.007.00

New Features

• Support for Azure File Share Cloud Connection which supports SFTP random read/write and file appending.
• Support for SFTP user and/or Admin login via LDAP and Active Directory LDAP Identity Providers.
• Configure users with an access expiration date to schedule denied access.

New application properties:

features.sftp-user.default-expiration-days=1

• Set this property to 1 or higher to automatically fill the New User screen with an expiration date when creating a user. If the property does not exist, there will not be a default expiration date. Default not set.

features.sftp-user.delete-default-home-folder-mapping-on-user-delete=true

• Set this property to true to delete a user’s home folder when the user is deleted. It will only delete the home folder if it is of the form /users/{username} and it inherits its cloud connection from the root. Default false.

features.sftp-user.purge-process.delete-user-after-expiration-days=0

features.sftp-user.purge-process.enabled=true

features.sftp-user.purge-process.cron=0 0 0 * * ?

• These three properties have to do with the purge process. The purge process is a scheduled job that automatically deletes expired users after a configured amount of days (features.sftp-user.purge-process.delete-user-after-expiration-days, defaults to 14). The process is disabled by default and must be enabled by setting features.sftp-user.purge-process.enabled=true (defaults to false). The job is scheduled to run once a day at midnight by default and the schedule can be adjusted by specifying a cron schedule to the property features.sftp-user.purge-process.cron.

Feature updates

• Different applications, such as s3fuse, can use the same metadata fields SFTP Gateway uses to store file modified time attributes. The applications could set the time using Epoch Milliseconds instead of the Epoch Seconds that SFTP Gateway uses. In this case, the Millisecond times would appear far in the future when viewing through an SFTP client. SFTP Gateway has been upgraded to support recognizing and reading the date in different time units to show the correct date regardless of the application writing the metadata.

• The Highly Available CloudFormation deployment now uses RDS IAM Authentication on AWS to connect to the database. This prevents the storage of the database password on the instance.

• The Highly Available CloudFormation deployment no longer assigns a Public IP address to the backend instances. Instead, the backend instances are in a private subnet and are connected through the Load Balancer.

• Improved Instance Credential usage to stabilize connections to cloud storage while using Instance Identity/instance profile

Bug fixes

• Fixed a bug where connecting to SFTP Gateway with an SFTP Client (such as Cyberduck) with an AWS S3 cloud connection could cause the system to hang due to starvation of http connections.

Version 3.006.01

Feature updates

• Support for SFTP user and/or Admin login via LDAP and Active Directory LDAP Identity Providers.
• Default S3 Multipart size increased from 4MB to 100MB to support 1 TB file uploads.
• AWS HA deployments now use RDS IAM Authentication instead of storing a password on the instance.
• Create 1000-user enterprise version for Marketplace.
• S3 Mutlipart size and simple upload size are now configurable.

Below are the property names and their default values:

features.file-system.aws-s3.max-multipart-part-size-bytes=123289600 //100 MB
features.file-system.aws-s3.max-simple-upload-size-bytes=123289600 //100 MB

Bug Fixes

• HNS enable/disable validation now works on new Azure Blob Cloud Connections.
• Admins logged in via OIDC can now edit other admin passwords if they logged in less than 10 minutes prior.
• Enforce a configurable timeout on Cloud Connectivity test so it does not hang too long on a bad connection:

defaults to features.file-system.connectivity-test-time-out-seconds=30

Version 3.006.00

Feature Updates

• Prevent a user from changing their password to one of their previously used passwords.

  • Set password.policy.prevent-previously-used-password-count=5, with a default value of 5, to increase or decrease the number of saved passwords.

  • Set the property less than or equal to 0 to disable checking previously used passwords.

• Configurable max file size for an imported backup file.

  • Set features.instance.backup-import-max-file-size-megabytes=100 to increase or decrease the allowed backup import size.

  • Increased default max file size from 10 MB to 100 MB.

• Beginning of tiered licenses for SFTP Gateway Standard and Pro versions.

Bug Fixes

• Adds password.policy.suggested-length property with a default value of 20 to fix a bug where the “Suggest Password” feature stops working if more than 20 total characters are required through the character classes.

Version 3.005.01

Feature Updates

• Support importing and migrating users with PBKDF2 HMAC SHA256 encoded passwords.
• Updates Strict KEX algorithm so it ends at first SSH_MSG_NEWKEYS received and not wait for ours to be sent to.
• AWS Base image upgraded from Amazon Linux 2 to Amazon Linux 2023.
• Upgrade Google Cloud SQL Proxy to v2 to support PSC to connect to database.
• Remove network calls from instance boot to support starting instances in networks with no egress.
• Improve listing speed for Google Cloud Storage.
• Adds boolean property to disable retrieving folder metadata to improve listing speeds.

defaults to features.file-system.ignore-folder-metadata=false

• Specify the number of minimum required characters in each class in password policy.

defaults to:

password.policy.required-upper-count=1
password.policy.required-digit-count=1
password.policy.required-lower-count=1
password.policy.required-special-count=1
password.policy.require-digit=false
password.policy.require-lower=false
password.policy.require-special=false
password.policy.require-upper=false

• Use imdsv2 on AWS for instance metadata.
• Upgrade postgresql 13 to postgresql 15 on ubuntu-based images.

Bug Fixes

• Immediately disconnecting a SFTP Client without closing the connection after a file upload will no longer cause the uploaded file to be deleted.
• Uploading a file with an extension and then uploading a file with the same name without an extension is now allowed.
• Update installation of certbot for lets encrypt.
• Fix logout when using Cognito OIDC so it requires credentials on next login attempt.
• Adjust application memory settings to give more memory to the OS to prevent swap thrashing on high load.
• Allow configuration of HNS enablement when using first cloud connection properties with azure.

Version 3.005.00

Breaking API Changes

• The /token/revoke endpoint is replaced with /logout, which does not need the token as a parameter.
• The /login endpoint no longer needs to specify a 'scope' value.
• The /password endpoint is now at /3.0.0/password.
• The OIDC login process now delivers a Single-use token to the front-end when OIDC login completes. The single use token is posted to the /login endpoint as a code parameter with a grant_type of 'urn:ietf:params:oauth:grant-type:single-use-auth' which returns a usable hybrid token. This change was made to ensure possibly leaked token values through query string parameters would not give an attacker access to an account.

Feature Updates

• Override which SFTP Encryption algorithms are available from the server in the Admin UI.
• Improve Admin UI by removing gutters and spanning the full-width of the browser.
• Upgrade user SSH key generation to produce ECDSA and ED25519 key pairs.
• Add Alibaba OSS as a Cloud Connection type.
• Pre-calculate user permissions and cloud connections to improve SFTP user connection speed.
• Add last login date to users table.
• Show Alibaba Logs in Diagnostics screen when running on Alibaba Cloud.
• Determine password strength while creating passwords using zxcvbn.
• Show password policy adherence while creating passwords.
• Require current admin’s password when changing the password for other admin users.
• Require current password when an admin is changing their own password.
• Add field to Azure Cloud Connections to configure if HNS is enabled or not.
• Increase max memory size for backend Java jar based on memory size of instance.
• AWS base image updated from Amazon Linux 2 to Amazon Linux 2023.
• AWS IMDSv2 now enabled, supported, and required.
• Improved Load Balancer support to get and act on actual Client IP behind a load balancer.
• Default password policy increased min length from 8 to 12.
• Default password policy no longer requires lower case, upper case, digit, and special characters.
• Default password policy uses a built-in word list of 100K prohibited passwords.

Bug Fixes

• Fix issue with failing to upload files larger than 50GB to AWS.
• Limit OIDC “prompt” query string parameter to Google Identity Providers (fixes OIDC to providers like Ping that do not support that parameter).
• Correct encoding of slashes in the base prefix for the Resolved Cloud Path for Azure Cloud Connections.
• Fix issue when importing a backup file with a conflicting name to an existing Cloud Connection.
• Ensure no connection errors when uploading more than 500 simultaneous files.
• Fix issue where many simultaneous connections from the same user could result in a failure to connect due to an ObjectOptimisticLockingFailureException.
• Pre-calculate user permissions and cloud connections to address bug where having many cloud connections could result in a database timeout.
• Ensure SSH Key Names imported from a backup are retained rather than replaced by SFTP username.
• Disable password expiration after a year on Linux root account.
• Show and allow navigation to folders that have a blank name.
• Removes automatic determination of HNS enablement on Azure Storage Accounts because it failed when using a System Assigned Identity. HNS is now specified when creating/editing Azure Cloud Connection.
• Specifying “None” permission on a folder for a user now prevents that user from listing that directory and instead will receive a permission denied message.
• Importing a backup file now supports files with UTF-8 characters.
• Importing a backup file with unsupported characters will now show errors with the line numbers of the unsupported characters.

Other

• Update Java version from 11 to 17.
• Update Spring Security from 5 to 6.
• Update Spring Boot from 2 to 3.
• Update Python2 to Python3.

Version 3.004.06

Security

• Addresses SSH protocol terrapin-attack vulnerability (Terrapin Attack) by providing strict key exchange countermeasure through maverick synergy 3.0.22.
• Addresses bouncycastle-fips CVE-2022-45146 by upgrading library to 1.0.2.4.

Bug Fixes

• Only send “prompt=select_account” extra parameter during identity provider login when identity provider starts with https://accounts.google.com to address compatibility with parameter on other OIDC providers.

Version 3.004.05

• Updated Maverick to 3.0.21 to address Passive SSH Key Compromise.

Version 3.004.04

Security

• Address Deserialization vulnerability in Admin api for OIDC that affects versions 3.004.01-3.004.03.
• Address snakeyaml CVE-2022-1471 by updating snakeyaml to 2.x.
• Address cve-2023-34034 by updating Spring Security.

Features

• Handle disconnect during file upload by deleting the partial file from cloud storage.
• Improve performance when many folders are defined for a user.
• Remove “Flagging IP Address” message when default IP Ban feature is disabled.
• Update azure-storage-blob sdk to 12.23.1.
• Update google-cloud-storage sdk to 2.26.0.
• Update aws sdks to 2.20.127 and 1.12.530.

Bug Fixes

• On Azure, the swap partition did not persist on reboot. It is now persisted across reboot.

Version 3.004.03

• List all files (even if more than 1,000) in Google Cloud Storage Buckets.
• Support file and folder names with backslash characters.

Version 3.004.02

Features

• Include Banner Text in exported backup file.
• Allow lack of “s3:ListAllMyBuckets” permission.
• Update Spring Security to address CVE-2023-20862.

Bug Fixes

• Show admin option to change password in admin ui.
• Show import errors when there are conflicts during import of Identity Providers.
• Resolve issue with newer ssh clients where RSA keys are rejected with message: sign_and_send_pubkey: no mutual signature supported.

Version 3.004.01

Features

• Allow access to logs and other diagnostic information via the new Diagnostics tab.
• Enable all SFTP host keys regardless of security level.
• Admin can configure additional OpenID Connect (oidc) scopes on the Identity Provider forms.

Bug Fixes

• Fixed bug that prevented synchronization between HA servers on AWS in v3.4.0.
• Fixed compatibility issue with Azure Monitor Agent.
• Admins can now change the storage account/container on the Azure Cloud Connection form.
• Refreshes Identity providers list on settings screen after backup import.
• Other UI Improvements.

Version 3.004.00

• Adds OIDC login for Web Admin UI.
• Allows configuration of multiple External Identity Providers to allow OIDC login to Web Admin UI.

Version 3.003.06

• Display cloud connection resolved path for a user’s home directory when creating or editing a user.
• Fixed bug that prevented deletion of user with multiple SSH Keys or IPs Allowed.
• Fixed bug that prevented deletion of a directory on Azure when Hierarchical Namespace is enabled on the Storage Account.
• Updated Spring Framework version to 5.3.20 to avoid CVEs from previous versions.
• Updated Cloud Storage SDKs
  • Updated AWS SDK to 2.18.28
  • Updated Google cloud storage library to 2.15.1
  • Updated Azure storage blob library to 12.20.1

Version 3.003.05

• Fixes issue when uploading files over 250 MB to AWS or Azure that pause at 100% and then report a failure. The problem was a timeout between the SFTP Gateway server and the cloud storage locations.
• Normalizes headers in the Admin UI for consistency.

Version 3.003.04

Features

• Improves performance of listing many files in Google Cloud Storage.
• Improves performance of uploading files in AWS S3.
• Adds a user-friendly Admin Landing Page on the http port.
• Adds warning message when Host Keys are not in imported backup file.
• Adds configuration and overrides of UID and GID for a user.

Bug Fixes

• Fixed a file creation bug that caused problems when using SSHFS.
• Fixed issue where the # symbol in filename cuts off the rest of the filename on Azure.
• Fixed issue where the pound sign # in the IP allow list label breaks the export/import process.

Version 3.003.03

Features

• Adds Integrated help system.
• Adds PROXY protocol support to receive client IP address behind a load-balancer.
• Migrate from Ubuntu 20 to Ubuntu 22 on Azure.
• Add Configuration of SFTP banner text to Admin UI.
• SFTP Users will not see existing files when viewing a folder with write-only permission. In previous versions, the users could list, but not download, files in write-only folders.
• SFTP Support for ed448 public and private keys.
• SFTP Support for PuTTY Version 3 Private Key format.

Bug Fixes

• Fixed disconnect issue when having multiple AWS regions configured for a user’s folders.
• Fix the configuration of password policy so requirements can be disabled The following application properties will disable each requirement:

password.policy.require-upper=false
password.policy.require-lower=false
password.policy.require-digit=false
password.policy.require-special=false

• Fixed VM Password support in Azure.
• Fixed issue with renaming folders on AWS where nested folders were not moved to the new name.
• Fixed SFTP v5 attribute flags being sent when using SFTP v4, which was breaking the listing of files in WinSCP in v3.3.2.

Version 3.003.02

• Solved bug where a user logging in at the same time as another user could result in the first user seeing the second user’s folders and files.
• Solved bug on Google Cloud Connection where empty files failed to write.
• Corrected the test of a Google Cloud Connection so it considers access to a bucket's metadata.
• Fixed issue with passwords imported from SFTPGWv2 not working after initial login.
• Corrected usage of Azure Instance Identity so it will pick up identities that are assigned after the instance has started.
• Enable Boot Diagnostics in the Azure ARM Templates.
• Correct bug where disabling automatic IP ban behavior did not work.
• Update local postgres service on Amazon Linux to use postgresql13 from official repository.
• Add support for version 3 of the PuTTY Private Key File Format.
• Add support for ED448 public/private keys.

Version 3.003.01

• Enables SCP support.
• Syncs server SSH host keys across HA instances, similar to the website key and SFTP host keys.
• Updates Spring and other dependencies to resolve possible CVEs.
• Displays the creation date (instead of 0) for folders created by the web admin portal.
• Improves Backup import service when merging Cloud Connection information.
• Enables HNS when creating Azure Blob Storage accounts.
• Caches Azure credentials when using Instance Identity to solve rate limits and long loading times that were occurring.
• Enables Serial console on Azure when using the ARM template.

Version 3.003.00

• Fixes WinSCP issue with subdirectories backed by Folder objects (WinSCP: error decoding sftp packet).
• Fixes compatibility with SFTP client software Panic Transmit.
• Shows whether an SSH public key was generated or was user-provided.
• Shows that the IP filter is disabled when the IP Allow List is empty.
• Shows Folder search results as paths.
• Adds a Test Connection button to the Cloud Connection creation process.
• Adds configuration option to disable automatic IP banning
• Adds configuration option to increase the file upload limit on Azure.

Version 3.002.01

• Updated SFTP Subsystem Maverick Library from 3.0.5 to 3.0.7
• Fixed bug that did not allow updating Azure Connection String to a new storage account
• Updated log4j api dependency to 2.17.1
• Resolved minor UI issues for Cloud Connection settings screens
• Fixed bug preventing write on an unencrypted S3 Cloud Connection to an encrypted s3 bucket

Version 3.002.00

• Adds Google Cloud Connection

Version 3.001.01

• UI improvements to the Cloud Connection settings page
• Refreshes status immediately when clicking the Test Connection button
• Displays loading screen when Java is not ready
• Fixes a bug with migration
• Adds clear-admin-users.sh script to reset (remove) web admin users
• Removes log4j yum package that wasn't in use
• Updates log4j-api dependency to 2.15.0
• Fixes a bug where the web page prompts you with basic authentication

Version 3.001.00

• Fixes a bug where SFTP users cannot log in via WinSCP
• Fixes a bug where passwords were not working after migrating from version 2
• Fixes a bug with the Test Connection feature for Cloud Connections
• Fixes a bug with the password constraint validator
• Various other bug fixes
• Prevents a web admin from disabling all web admins
• Adds Admin UI protection from brute force attacks
• Various UI improvements

Version 3.000.01

• Fixes a bug when displaying file last modified date
• Improves backup and restore support
• Adds SFTP subsystem log messages to the application.log
• Adds username to Nginx access logs
• Various other bug fixes

Version 3.000.00

SFTP files and folders

• Read and write files directly to Blob, using the SFTP protocol
• Configure folder permissions with read-only, read/write, or write-only
• Map an SFTP user's chroot directory to a Blob container and path
• Folder mapping lets you configure a common scenario where an internal SFTP user has read/write access to external SFTP users' data, while external users cannot see each other's data

SFTP accounts

• Authenticate SFTP users with passwords or SSH keys
• Supports multiple SSH keys per SFTP user
• Adds password complexity requirements
• Adds disabled flag for SFTP users
• Configures IP whitelisting at the user level

Web administration

• Supports multiple web admin accounts
• Simplifies first-time setup, which can be done entirely from the web admin UI (no command line required)
• Imports users and settings from SFTP Gateway 2.x via a migration process

Security

• Has undergone an independent third-party security audit
• Separates SSH and SFTP onto different ports by default
• Enables audit logging to track SFTP actions

Performance and maintenance

• Improves performance and scalability through the use of the Azure SDK for Java
• Uses Postgres instead of LDAP, for easier maintenance

Cost

• Same pricing as SFTP Gateway 2.x, which is a software charge of 8 cents USD per VM hour
• 30-day free trial