Apache MINA SSHD (Product): news timeline & CVEs

CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap

Apache MINA SSHD sshd-ldap has critical LDAP injection flaw CVE-2026-94053 that can bypass authentication.

Apache disclosed CVE-2026-94053, a critical LDAP injection flaw in the optional sshd-ldap component of Apache MINA SSHD, a Java SSH library. The vulnerability allows authentication bypass and is scored CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Affected versions are 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5, with 2.20.0 and 3.0.0-M6 listed as the first unaffected releases. The notice, posted by Thomas Wolf, does not report exploitation in the wild.

oss-securitySep 29, 18:31 UTC · 17d agoVulnerability 7 sources CVE-2026-940532· 1 read

CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

Apache MINA SSHD SFTP clients can be memory-exhausted by unsolicited replies before 2.20.0 and 3.0.0-M6.

Apache MINA SSHD SFTP clients can suffer memory exhaustion when DefaultSftpClient in sshd-sftp processes unsolicited SFTP replies. CVE-2026-94002 covers 0.9.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5, with fixes in 2.20.0 and 3.0.0-M6. CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); Apache rates it moderate. The post does not report exploitation.

oss-securitySep 29, 18:25 UTC · 17d agoVulnerability 7 sources CVE-2026-940021

CVE-2026-93996: Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read

Apache MINA SSHD sshd-scp allows a privileged memory-exhaustion denial of service via unbounded SCP reads.

Apache MINA SSHD's sshd-scp component can be driven into memory exhaustion by an unbounded SCP command-line read. CVE-2026-93996 affects releases through 2.19.0 and milestones 3.0.0-M1 through 3.0.0-M5; 2.20.0 and 3.0.0-M6 are the fixed lines. CVSS 3.1 is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and Apache rates severity moderate. No active exploitation is mentioned.

oss-securitySep 29, 18:23 UTC · 17d agoVulnerability 7 sources CVE-2026-939962· 1 read

CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server

Authenticated users can make Apache MINA SSHD sshd-git write a server file via a JGit archive command.

Improper input validation in Apache MINA SSHD's sshd-git component lets a remote authenticated user cause a file write on the server through JGit's "archive -o=file.zip" handling. CVE-2026-93995 affects versions up to 2.19.0 and 3.0.0-M1 through 3.0.0-M5, addressed in 2.20.0 and 3.0.0-M6. CVSS 3.1 is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation is not reported.

oss-securityupdated Sep 29, 18:31 UTC · 17d agofirst Sep 29, 18:20 UTC · 17d agoVulnerability 7 sources CVE-2026-939953· 1 read

CVE-2026-93994: Apache MINA SSHD: Repeated-publickey policy bypass on server

Apache MINA SSHD can bypass a repeated-publickey multi-authentication requirement, CVE-2026-93994, CVSS 8.1.

Apache MINA SSHD servers configured to require multiple distinct public keys can have that repeated-publickey policy bypassed. CVE-2026-93994 is rated important, with CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Affected builds are those before 2.20.0 and milestones 3.0.0-M1 through 3.0.0-M5. The disclosure does not say the bypass is being exploited.

oss-securityupdated Sep 29, 18:31 UTC · 17d agofirst Sep 29, 18:18 UTC · 17d agoVulnerability 7 sources CVE-2026-939941

Apache MINA SSHD

Timeline5 articles

Related CVEsby mentions

Appears with

CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap

CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

CVE-2026-93996: Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read

CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server

CVE-2026-93994: Apache MINA SSHD: Repeated-publickey policy bypass on server