CVE-2026-42779

CVE-2026-42779 — Omisión del Filtro de Deserialización de Apache MINA que Conduce a RCE CVSS 3.1: 9.8 CRÍTICO AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-502 Deserialización de Datos No Confiables Reportero: Venkatraman Kumar, Securin Aviso: Lista de Correo de Apache Resumen Las versiones de...

CVE-2026-42778-POC

CVE-2026-42778 Resumen Corrección incompleta en el método AbstractIoBuffer.getObject de Apache MINA. La validación de la lista blanca de nombres de clase que restringe qué clases pueden deserializarse se aplica demasiado tarde, después de que los inicializadores estáticos de las clases que se est...

apache-mina-deserialization-security-assessment

CVE-2024-52046 - RCE por Deserialización en Apache MINA Informe de Ciberseguridad en Estilo Consultoría Informe profesional de evaluación de vulnerabilidades sobre el riesgo de deserialización en Apache MINA, que incluye resumen ejecutivo, impacto técnico, remediación y estrategia de mitigación. ...

CVE-2026-94029

A flaw was found in Apache MINA SSHD. When processing SSH File Transfer Protocol SFTP check-file extensions, the server accumulates file hash verification responses entirely in memory without enforcing a size limit. An authenticated remote attacker can exploit this vulnerability by requesting fil...

CVE-2026-94002

A flaw was found in the sshd-sftp component of Apache MINA SSHD. This vulnerability allows a malicious server to cause a Denial of Service DoS on the client by exhausting system memory. The SFTP SSH File Transfer Protocol client fails to verify whether incoming replies correspond to previously se...

CVE-2026-93994

A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell SSH public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key...

CVE-2026-94052

A flaw was found in the sshd-ldap component of Apache MINA SSHD. Due to a missing verification check in the Lightweight Directory Access Protocol LDAP password authenticator LdapPasswordAuthenticator, user credentials are not properly validated. A remote, unauthenticated attacker can exploit this...

CVE-2026-93995

A flaw was found in Apache MINA SSHD. The sshd-git module does not properly restrict command-line arguments when executing Git commands over Secure Shell SSH connections. An authenticated remote attacker can exploit this issue by providing a crafted output parameter during an archive operation...

CVE-2026-94053

A flaw was found in the sshd-ldap component of Apache MINA SSHD. This vulnerability allows an unauthenticated remote attacker to bypass authentication due to improper escaping of LDAP Lightweight Directory Access Protocol filter metacharacters during credential verification. By supplying speciall...

CVE-2026-94052

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for...

DEBIAN-CVE-2026-94053

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94029

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

CVE-2026-94053

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-77185

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain presumed rare way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform...

CVE-2026-94002

Possible memory exhaustion in SFTP clients DefaultSftpClient in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client...

DEBIAN-CVE-2026-94002

Possible memory exhaustion in SFTP clients DefaultSftpClient in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client...

CVE-2026-93996

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol ...

CVE-2026-93995

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD...

CVE-2026-93994

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

EUVD-2026-89759

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain presumed rare way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform...