Apache MINA SSHD (Organization): news timeline & CVEs

CVE-2026-94052: Apache MINA SSHD: LDAP password authentication ineffective

CVE-2026-94052 (CVSS 9.1) lets unauthenticated attackers bypass LDAP password authentication in Apache MINA SSHD sshd-ldap.

A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD bypasses authentication checks. The flaw, CVE-2026-94052, is rated critical with CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact. Affected versions are 1.2.0 before 2.20.0 and 3.0.0-M1 before 3.0.0-M6; users should upgrade to 2.20.0 or 3.0.0-M6.

oss-securitySep 29, 18:29 UTC · 17d agoVulnerability 7 sources CVE-2026-940522

CVE-2026-94029: Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

CVE-2026-94029 (CVSS 6.5) allows low-privileged users to exhaust server memory via Apache MINA SSHD SFTP v6 extensions.

Server-side memory exhaustion affects the sshd-sftp component of Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, in the SFTP v6 check-file-name/check-file-handle extension. CVE-2026-94029 is rated moderate with CVSS 3.1 6.5, requiring low privileges, with high availability impact. The issue is fixed in versions 2.20.0 and 3.0.0-M6.

oss-securitySep 29, 18:27 UTC · 17d agoVulnerability 7 sources CVE-2026-94029

CVE-2026-77185: Apache MINA SSHD: Asynchronous authentication can bypass signature verification

Critical CVE-2026-77185 in Apache MINA SSHD lets attackers bypass signature verification via asynchronous authentication; CVSS 9.1, fixed in 2.20.0 and 3.0.0-M6.

CVE-2026-77185 (CVSS 3.1: 9.1, AV:N/AC:L/PR:N/UI:N) is an authentication bypass in sshd-core of Apache MINA SSHD affecting versions 2.0.0 before 2.20.0 and 3.0.0-M1 before 3.0.0-M6. The flaw allows signature verification to be bypassed when asynchronous authentication is used in a certain, presumed rare, way of implementing an SSH server. Upgrading to 2.20.0 or 3.0.0-M6 resolves the issue.

oss-securitySep 29, 18:16 UTC · 17d agoVulnerability CVE-2026-771851· 1 read

Apache MINA SSHD

Timeline3 articles

Related CVEsby mentions

Appears with

CVE-2026-94052: Apache MINA SSHD: LDAP password authentication ineffective

CVE-2026-94029: Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

CVE-2026-77185: Apache MINA SSHD: Asynchronous authentication can bypass signature verification