org.apache.sshd:apache-sshd (>=3.0.0-m1, <=3.0.0-m5) potentially affected by CVE-2026-77185 via org.apache.sshd:sshd-osgi (>=3.0.0-m1, <=3.0.0-m5)

org.apache.sshd:sshd-osgi MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m5 Source cves: CVE-2026-77185 Source advisory: MEND:CVE-2026-77185...

CVE-2026-77185

The Apache MINA SSHD Java library contains an authentication bypass vulnerability in the sshd-core component affecting versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 . The root cause is a logic error in the asynchronous authentication mechanism, which can lead to skipping signature verificatio...

CVE-2026-77185

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain presumed rare way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform...

CVE-2026-77185 Apache MINA SSHD: Asynchronous authentication can bypass signature verification

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain presumed rare way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform...

Resource Exhaustion

Apache Qpid Proton-J is vulnerable to resource exhaustion. The vulnerability is due to the inability to govern the maximum number of transfer frames per incoming delivery, where the library does not enforce a limit on the number of frames and an authenticated attacker can send deliveries with...

EUVD-2026-89758

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

CVE-2026-93994

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

CVE-2026-93994 Apache MINA SSHD: Repeated-publickey policy bypass on server

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

CVE-2026-93994

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

CVE-2026-93994

The Apache MINA SSHD Java library is affected by a partial authentication bypass in versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 . The vulnerability exists in the sshd-core component, where the server fails to enforce that two distinct public keys are used when a multi-authentication policy (e....

CVE-2026-93994 Apache MINA SSHD: Repeated-publickey policy bypass on server

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

org.apache.sshd:apache-sshd (>=3.0.0-m1, <=3.0.0-m5) potentially affected by CVE-2026-93994 via org.apache.sshd:sshd-osgi (>=3.0.0-m1, <=3.0.0-m5)

org.apache.sshd:sshd-osgi MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m5 Source cves: CVE-2026-93994 Source advisory: MEND:CVE-2026-93994...

CVE-2026-94053 Apache MINA SSHD: LDAP injection in sshd-ldap

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94053 Apache MINA SSHD: LDAP injection in sshd-ldap

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94053

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

org.apache.sshd:apache-sshd (>=3.0.0-m1, <=3.0.0-m5) potentially affected by CVE-2026-94053 via org.apache.sshd:sshd-ldap (>=3.0.0-m1, <=3.0.0-m5)

org.apache.sshd:sshd-ldap MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m5 Source cves: CVE-2026-94053 Source advisory: MEND:CVE-2026-94053...

CVE-2026-94053

The Apache MINA SSHD Java library is vulnerable to an authentication bypass via LDAP injection within the optional sshd-ldap component. The root cause is a lack of proper escaping for LDAP filter metacharacters, which allows an attacker to successfully authenticate using the username "" and passw...

io.github.gitbucket:gitbucket_2.13 (>=4.37.0, <=4.48.0), org.apache.sshd:apache-sshd (>=2.2.0, <=2.19.0) +2 more potentially affected by CVE-2026-94053 via org.apache.sshd:sshd-ldap (>=2.2.0, <=2.19.0)

org.apache.sshd:sshd-ldap MAVEN version =2.2.0, =4.37.0, =2.2.0, =2.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-94053 Source advisory: MEND:CVE-2026-94053...

EUVD-2026-89757

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94053

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...