CVE-2026-94002

A flaw was found in the sshd-sftp component of Apache MINA SSHD. This vulnerability allows a malicious server to cause a Denial of Service DoS on the client by exhausting system memory. The SFTP SSH File Transfer Protocol client fails to verify whether incoming replies correspond to previously se...

CVE-2026-93994

A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell SSH public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key...

SUSE CVE-2026-77185

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain presumed rare way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform...

SUSE CVE-2026-93994

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

SUSE CVE-2026-93995

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD...

SUSE CVE-2026-93996

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol ...

SUSE CVE-2026-94002

Possible memory exhaustion in SFTP clients DefaultSftpClient in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client...

SUSE CVE-2026-94029

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" for instance 256,...

SUSE CVE-2026-94052

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for...

SUSE CVE-2026-94053

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94052

A flaw was found in the sshd-ldap component of Apache MINA SSHD. Due to a missing verification check in the Lightweight Directory Access Protocol LDAP password authenticator LdapPasswordAuthenticator, user credentials are not properly validated. A remote, unauthenticated attacker can exploit this...

Uncontrolled Resource Consumption

Apache Neethi is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to insufficient enforcement of the maximum number of normalized policy alternatives, which allows an attacker to submit crafted policies that bypass the limit and consume excessive resources, causing a...

CVE-2026-93995

A flaw was found in Apache MINA SSHD. The sshd-git module does not properly restrict command-line arguments when executing Git commands over Secure Shell SSH connections. An authenticated remote attacker can exploit this issue by providing a crafted output parameter during an archive operation...

CVE-2026-94053

A flaw was found in the sshd-ldap component of Apache MINA SSHD. This vulnerability allows an unauthenticated remote attacker to bypass authentication due to improper escaping of LDAP Lightweight Directory Access Protocol filter metacharacters during credential verification. By supplying speciall...

Uncontrolled Resource Consumption

Apache Qpid Proton-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper handling of deeply nested types, which allows a pre-authentication attacker to trigger a StackOverflowError and cause a denial-of-service condition...

Cross-site Scripting (XSS)

Apache Wicket is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of attacker-influenced model data rendered inside elements, which allows an attacker to inject and execute malicious HTML or script content in a victim's browser...

CVE-2026-86248

A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol OCSP verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or...

CVE-2026-88920

A flaw was found in Apache WSS4J. This vulnerability in the Document Object Model DOM security processor allows an unauthenticated remote attacker to bypass authentication and forge authenticated Simple Object Access Protocol SOAP messages. An attacker can exploit this issue by submitting a...

DEBIAN-CVE-2026-92899

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

CVE-2026-92899

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...