CVE-2026-94029: Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension
CVE-2026-94029 (CVSS 6.5) allows low-privileged users to exhaust server memory via Apache MINA SSHD SFTP v6 extensions.
Server-side memory exhaustion affects the sshd-sftp component of Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, in the SFTP v6 check-file-name/check-file-handle extension. CVE-2026-94029 is rated moderate with CVSS 3.1 6.5, requiring low privileges, with high availability impact. The issue is fixed in versions 2.20.0 and 3.0.0-M6.
- Memory exhaustion DoS in SFTP v6 check-file-name and check-file-handle extensions
- Requires low privileges; high availability impact, CVSS 6.5
- Affects 1.0.0-2.19.0 and 3.0.0-M1-3.0.0-M5; fixed in 2.20.0 and 3.0.0-M6
Vulnerabilities mentionedAll →
- CVE-2026-940296.5—Memory exhaustion in Apache MINA SSHD SFTP check-filepublished · Apache MINA SSHD
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-94029 | Memory exhaustion in Apache MINA SSHD SFTP check-file Apache MINA SSHD 1.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5 can exhaust server memory in the sshd-sftp component when handling the SFTP v6 check-file-name or check-file-handle extension. An authenticated remote attacker who requests a check of a very large or sparse file with a very small block size (as low as 256 bytes) makes the server compute one hash per block and buffer the entire reply in memory with no size cap, which can crash the SSH server. Impact is limited to availability; confidentiality and integrity are not affected, and low privileges are required. Servers and applications that embed the affected library with SFTP enabled are in scope. No public proof of concept is known, and the issue is not listed in CISA KEV. |
Posted by Thomas Wolf on Sep 29 Severity: moderate CVSS 3.1: 6.5 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected versions: - Apache MINA SSHD 1.0.0 before 2.20.0 - Apache MINA SSHD 3.0.0-M1 before 3.0.0-M6 Description: Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and...
This source does not provide full text. Read it at seclists.org.