CVE-2026-94002

Possible memory exhaustion in SFTP clients DefaultSftpClient in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client...

CVE-2026-94002

The Apache MINA SSHD library (component sshd-sftp ) is vulnerable to memory exhaustion in the DefaultSftpClient implementation. The root cause is that the SFTP client fails to verify if a received reply corresponds to a previously sent request; consequently, unsolicited replies are stored indefin...

EUVD-2026-89753

Possible memory exhaustion in SFTP clients DefaultSftpClient in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client...

CVE-2026-94002 Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

Possible memory exhaustion in SFTP clients DefaultSftpClient in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client...

CVE-2026-94029

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

CVE-2026-94029 Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

EUVD-2026-89731

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

CVE-2026-94029

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

CVE-2026-94029 Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

CVE-2026-94029

The Apache MINA SSHD Java library (versions 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5) is vulnerable to server-side memory exhaustion within the sshd-sftp component. The issue occurs in the SFTP v6 check-file-name/check-file-handle extension when a user provides a very small block size (e.g., 256)...

CVE-2026-94052 Apache MINA SSHD: LDAP password authentication ineffective

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for...

CVE-2026-94052 Apache MINA SSHD: LDAP password authentication ineffective

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for...

io.github.gitbucket:gitbucket_2.13 (>=4.37.0, <=4.48.0), org.apache.sshd:apache-sshd (>=2.2.0, <=2.19.0) +2 more potentially affected by CVE-2026-94052 via org.apache.sshd:sshd-ldap (>=2.2.0, <=2.19.0)

org.apache.sshd:sshd-ldap MAVEN version =2.2.0, =4.37.0, =2.2.0, =2.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-94052 Source advisory: MEND:CVE-2026-94052...

org.apache.sshd:apache-sshd (>=3.0.0-m1, <=3.0.0-m5) potentially affected by CVE-2026-94052 via org.apache.sshd:sshd-ldap (>=3.0.0-m1, <=3.0.0-m5)

org.apache.sshd:sshd-ldap MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m5 Source cves: CVE-2026-94052 Source advisory: MEND:CVE-2026-94052...

CVE-2026-94052

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for...

EUVD-2026-89730

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for...

CVE-2026-94052

The Apache MINA SSHD Java library (versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 ) contains a vulnerability in the optional sshd-ldap component. A missing check in the LdapPasswordAuthenticator allows attackers to bypass authentication checks when the component is configured for LDAP password...

Rocky Linux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc (ALMALINUX9.6:CLSA-2026:1784636012)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784636012 advisory. - sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. CVE-2026-60001 Note that Nessus has not tested for th...

PT-2026-103103

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions 2.0.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 Description An authentication bypass exists in the sshd-core component of this Java library for client- and server-side SSH. The issue stems fro...

CVE-2026-77185: Authentication Bypass by Primary Weakness

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain presumed rare way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform...