CVE-2026-94002

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions 0.9.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5

Description The sshd-sftp component of the Apache MINA SSHD Java library contains a flaw in the DefaultSftpClient implementation. When receiving a reply, the client fails to verify if the response corresponds to a previously sent request. Consequently, unsolicited replies are stored without being consumed, allowing a malicious server to send continuous unsolicited responses until the client's available memory is exhausted, leading to memory exhaustion.

Recommendations Upgrade versions 0.9.0 through 2.19.0 to version 2.20.0. Upgrade versions 3.0.0-M1 through 3.0.0-M5 to version 3.0.0-M6.