CVE-2026-93996: Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read

Apache MINA SSHD’s sshd-scp component reads SCP protocol lines without any length limit. A malicious peer that has low privileges can send a junk SCP command of characters that never includes a line feed, so the receiver keeps allocating memory until the process crashes with an OutOfMemoryError. Impact is denial of service only (high availability impact, no confidentiality or integrity loss); CVSS 3.1 scores it 6.5 and requires network access with low privileges and no user interaction. Java applications that embed Apache MINA SSHD through 2.19.0, or the 3.0.0-M1 through 3.0.0-M5 milestones, and that use the SCP implementation are affected. No public proof of concept is known and the issue is not in CISA KEV.

Upgrade Apache MINA SSHD to 2.20.0 or 3.0.0-M6, which enforce an upper limit on SCP protocol line length. Inventory Java applications that bundle older MINA SSHD and use the SCP implementation, then replace those libraries and restart the affected services.