CVE-2026-94029

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions 1.0.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5

Description Server-side memory exhaustion occurs in the sshd-sftp component within the SFTP v6 check-file-name/check-file-handle extension. When a very small block size is used on a large file, the system generates an excessive number of hashes. Because the resulting SFTP reply message is accumulated entirely in the server memory, a sufficiently large or sparse file can exhaust available memory and cause the server to crash.

Recommendations Upgrade versions 1.0.0 through 2.19.0 to version 2.20.0. Upgrade versions 3.0.0-M1 through 3.0.0-M5 to version 3.0.0-M6.