CVE-2026-94002

Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

State: Published
Severity: 7.5 High
Published: Sep 30, 2026
Updated: Sep 30, 2026
Reserved: Sep 19, 2026

Description

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.

Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.

The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	apache

Weaknesses

CWE-770 Allocation of resources without limits or throttling

Affected Products

Product	Versions
Apache MINA SSHDApache Software Foundation	0.9.0 to before 2.20.0Affected 3.0.0-M1 to before 3.0.0-M6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.