CVE-2026-94002
published 2026-09-30CVE-2026-94002: Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.43%
35.8th percentile
Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
Apache
MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.
The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.
Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_mina_sshd | >= 0.9.0 < 2.20.0 | 2.20.0 |
| apache_software_foundation | apache_mina_sshd | >= 3.0.0-M1 < 3.0.0-M6 | 3.0.0-M6 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
ghsa_unreviewed·2026-09-30
CVE-2026-94002 [HIGH] CWE-770 Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
Apache
MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.
The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.
Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
Red Hat
org.apache.sshd/sshd-sftp: Apache MINA SSHD: Denial of Service via unsolicited SFTP replies
vendor_redhat·2026-09-30·CVSS 7.5
CVE-2026-94002 [HIGH] CWE-770 org.apache.sshd/sshd-sftp: Apache MINA SSHD: Denial of Service via unsolicited SFTP replies
org.apache.sshd/sshd-sftp: Apache MINA SSHD: Denial of Service via unsolicited SFTP replies
A flaw was found in the sshd-sftp component of Apache MINA SSHD. This vulnerability allows a malicious server to cause a Denial of Service (DoS) on the client by exhausting system memory. The SFTP (SSH File Transfer Protocol) client fails to verify whether incoming replies correspond to previously sent requests, indefinitely retaining unrequested replies. A rogue server can exploit this by continuously sending unsolicited messages until all available client memory is consumed.
Package: sshd-sftp (Red Hat build of Apache Camel 4 for Quarkus 3) - Affected
Package: sshd-sftp (Red Hat build of Apache Camel for Spring Boot 4) - Affected
Package: sshd-sftp (Red Hat build of Apicurio Registry 3) - Affe
No detection rules found.
No public exploits indexed.
2026-09-30
Published