AI analysis
Apache MINA SSHD 1.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5 can exhaust server memory in the sshd-sftp component when handling the SFTP v6 check-file-name or check-file-handle extension. An authenticated remote attacker who requests a check of a very large or sparse file with a very small block size (as low as 256 bytes) makes the server compute one hash per block and buffer the entire reply in memory with no size cap, which can crash the SSH server. Impact is limited to availability; confidentiality and integrity are not affected, and low privileges are required. Servers and applications that embed the affected library with SFTP enabled are in scope. No public proof of concept is known, and the issue is not listed in CISA KEV.
What to do: Upgrade Apache MINA SSHD to 2.20.0 or 3.0.0-M6, which limit the size of the check-file reply. Until then, restrict SFTP to trusted accounts and watch SSH server processes for unexpected memory growth. Because this is a library, update any products that bundle the sshd-sftp component, not only standalone installs.
Affected
| Apache MINA SSHD | 1.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" (for instance 256, which is the minimum) on a huge file generates many (file size / block size) hashes. The resulting SFTP reply message was accumulated fully in memory server-side, which could, with a suitably large (possibly sparse) file exhaust the server-side memory, taking down the server. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by imposing a maximum limit on the size of the reply. Many SFTP implementations have a general limit on the size of SFTP messages anyway; typically 256kB as in OpenSSH or also in Apache MINA SSHD.