CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
Apache MINA SSHD SFTP clients can be memory-exhausted by unsolicited replies before 2.20.0 and 3.0.0-M6.
Apache MINA SSHD SFTP clients can suffer memory exhaustion when DefaultSftpClient in sshd-sftp processes unsolicited SFTP replies. CVE-2026-94002 covers 0.9.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5, with fixes in 2.20.0 and 3.0.0-M6. CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); Apache rates it moderate. The post does not report exploitation.
- CVE-2026-94002 affects DefaultSftpClient in the sshd-sftp component.
- Unsolicited SFTP replies can exhaust client memory; CVSS 3.1 is 7.5.
- Affected ranges are 0.9.0–2.19.0 and 3.0.0-M1–3.0.0-M5.
- Impact is availability only; no in-the-wild exploitation is stated.
Vulnerabilities mentionedAll →
- CVE-2026-940027.5—Memory exhaustion in Apache MINA SSHD SFTP clientpublished · Apache MINA SSHD (sshd-sftp / DefaultSftpClient)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-94002 | Memory exhaustion in Apache MINA SSHD SFTP client Apache MINA SSHD’s SFTP client (DefaultSftpClient in sshd-sftp) can be driven to memory exhaustion by a malicious server. When a reply arrives, the client does not check that it matches a request it previously sent, so unsolicited replies are stored and never consumed. A hostile SFTP server can keep sending those replies until the client process runs out of memory, causing a denial of service (availability only; no confidentiality or integrity impact). Any application using Apache MINA SSHD 0.9.0 through 2.19.0 or 3.0.0-M1 through 3.0.0-M5 as an SFTP client against an untrusted server is affected. There is no known public proof of concept and the issue is not listed in CISA KEV. Upgrade Apache MINA SSHD to 2.20.0 or 3.0.0-M6, which reject unsolicited SFTP replies. Until then, do not point DefaultSftpClient (sshd-sftp) at untrusted servers, and scan application dependency trees for the affected ranges. |
Posted by Thomas Wolf on Sep 29 Severity: moderate CVSS 3.1: 7.5 (high) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected versions: - Apache MINA SSHD 0.9.0 before 2.20.0 - Apache MINA SSHD 3.0.0-M1 before 3.0.0-M6 Description: Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The...
This source does not provide full text. Read it at seclists.org.