DEBIAN-CVE-2026-94029

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

UBUNTU-CVE-2026-94029

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the SFTP v6 check-file-name/check-file-handle extension in AbstractSftpSubsystemHelper. An attacker can exhaust server memory and take down the SFTP server by requesting hashes fo...

CVE-2026-94029 Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

CVE-2026-94029 Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

EUVD-2026-89731

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

CVE-2026-94029

The Apache MINA SSHD Java library (versions 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5) is vulnerable to server-side memory exhaustion within the sshd-sftp component. The issue occurs in the SFTP v6 check-file-name/check-file-handle extension when a user provides a very small block size (e.g., 256)...

CVE-2026-94029

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

CVE-2026-94029

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

CVE-2026-94029

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

Crosswork Data Gateway Path Traversal

The vulnerability of the Crosswork Data Gateway data collection platform is related to improper external management of file names or paths. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2026-103109

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions 1.0.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 Description Server-side memory exhaustion occurs in the sshd-sftp component within the SFTP v6 check-file-name/check-file-handle extension. When...

CVE-2026-93813

A flaw was found in the Linux kernel's Btrfs file system. The file system validation mechanism fails to properly verify file name lengths in file reference entries, leading to an out-of-bounds memory access when processing corrupted data. A local attacker can exploit this issue by mounting or...

PT-2026-98384

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.43 Description The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder...

CVE-2026-91797

Foxit PDF Editor/Reader is vulnerable to a directory traversal flaw because it fails to validate the directory traversal path in the attachment file name. This vulnerability allows malicious attachments to be written to directories outside the expected secure area when a PDF is opened. No specifi...

CVE-2026-91797 Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened...

CVE-2026-91797 Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened...

EUVD-2026-85125

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened...

CVE-2026-57576

The plone.app.dexterity and plone.app.contenttypes components of the Plone content management system are vulnerable to a denial of service (DoS) attack. An authenticated user can trigger this by creating content with excessively long titles , descriptions, or uploaded-file names, which causes the...

CVE-2026-65125

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service...