CVE-2026-93996: Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read
Apache MINA SSHD sshd-scp allows a privileged memory-exhaustion denial of service via unbounded SCP reads.
Apache MINA SSHD's sshd-scp component can be driven into memory exhaustion by an unbounded SCP command-line read. CVE-2026-93996 affects releases through 2.19.0 and milestones 3.0.0-M1 through 3.0.0-M5; 2.20.0 and 3.0.0-M6 are the fixed lines. CVSS 3.1 is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and Apache rates severity moderate. No active exploitation is mentioned.
40