Learn what's new across releases, with details of features, enhancements, and resolved issues.
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Rebex Buru SFTP Server 2.20.0Major versionJun 22, 2026
Features
Improved handling of broken SSH INIT ML-KEM packets.
Fixes
Fixed possible deadlock while SSH session is being renegotiated.
Fixed handling of SFTP SSH_FXP_RENAME_OVERWRITE.
Fixed wrong length detection in SSH_FXP_WRITE packet parser.
Rebex Buru SFTP Server 2.19.0Major versionMay 25, 2026
Features
Added support for Argon2 password hashing. Argon2 is a memory-hard algorithm significantly more resistant to brute-force attacks than SHA-2, at the cost of higher memory and CPU usage per login. Enable it by setting users.passwordHashAlgorithm: { type: argon2id } in config.yaml. Argon2 parameters such as memory cost and parallelism can be configured explicitly.
Extended users.passwordHashAlgorithm in config.yaml to accept an object form ({ type: argon2id }, { type: SHA512, saltLength: 20 }) in addition to the existing string form (SHA512). The string form remains supported.
Added --password-hash option to burusftp user update command (mirrors the existing option in burusftp user add).
Web Admin: Added "Add new user" button to the users toolbar.
Web Admin: Added Save button to the breadcrumb bar on selected pages.
Fixes
Web Admin: Fixed breadcrumbs on the Protection and FTP settings pages.
Rebex Buru SFTP Server 2.18.4Mar 19, 2026
Fixes
Fixed incorrect Windows privilege check for terminal shell running as a different user. The service now correctly requires the 'Replace a process level token' (SeAssignPrimaryTokenPrivilege) and 'Adjust memory quotas for a process' (SeIncreaseQuotaPrivilege) privileges, rather than the overly broad 'Act as part of the operating system' (SeTcbPrivilege) privilege.
Fixed diffie-hellman-group17-sha512 and diffie-hellman-group18-sha512 being advertised but not usable as kex algorithms.
Web Admin - fixed incorrect hours displayed in placeholder text for max idle duration and max session duration fields.
Rebex Buru SFTP Server 2.18.3Feb 20, 2026
Fixes
Fixed LiteDB database locking error.
Web Admin - log viewer now only shows the last 50kB and adds an option to view or download the entire log file.
Rebex Buru SFTP Server 2.18.2Feb 10, 2026
Fixes
Fixed behavior of 'ftp.bindings[].externalAddress' and 'ftp.bindings[].dataPortRange' in FTPS implicit mode.
Rebex Buru SFTP Server 2.18.1Feb 9, 2026
Fixes
Fixed a compatibility issue with some SSH clients by changing the SSH message order for SSH shell channels.
Rebex Buru SFTP Server 2.18.0Major versionJan 8, 2026
Features
Major overhaul of SSH/SFTP core - improved performance, thread and memory usage in some scenarios.
Added support for 'mlkem768x25519-sha256', 'mlkem768nistp256-sha256' and 'mlkem1024nistp384-sha384' hybrid post-quantum key exchange ciphers.
Added support for 'diffie-hellman-group17-sha512' and 'diffie-hellman-group18-sha512' key exchange ciphers.
Added support for copy-data SFTP extension.
Improved performance of elliptic curve algorithms on modern platforms.
Installer - when upgrading, now checks the current license before overwriting the existing installation.
Fixes
Fixed intermittent crash when SSH terminal client disconnects.
Web Admin - fixed 2FA status not being indicated correctly for some users.