Description
Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.




Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.




Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.
Published: 2026-09-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory exhaustion leading to denial of service
Action: Patch
AI Analysis

Impact

Uncontrolled resource consumption in the SSHD SCP component allows a malicious peer to send an exceedingly long SCP command line that never terminates with a line feed. The protocol handler allocates memory for the entire command, eventually exhausting available memory and causing the application to crash with an OutOfMemoryError. This results in a denial‑of‑service condition for the SSH service and any dependent applications.

Affected Systems

The issue affects Apache Software Foundation’s Apache MINA SSHD library in all releases up to version 2.19.0 and up to 3.0.0‑M5. Users running these or earlier releases are potentially vulnerable.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via an SSH connection that supplies the malicious SCP command. No additional exploit prerequisites are mentioned, implying that any unauthenticated or authenticated attacker could trigger the denial of service by exploiting the unbounded input processing.

Generated by OpenCVE AI on September 30, 2026 at 11:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache MINA SSHD to version 2.20.0 or 3.0.0-M6, which limits the length of SCP protocol lines and prevents memory exhaustion.
  • If an immediate upgrade is not feasible, restrict SSH access to trusted clients or disable the SCP protocol entirely to mitigate the risk.
  • Monitor the JVM memory usage and logs for OutOfMemoryError events, and configure appropriate memory limits for the Java process to contain potential impact.

Generated by OpenCVE AI on September 30, 2026 at 11:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache mina Sshd
Vendors & Products Apache
Apache mina Sshd

Wed, 30 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
References

Wed, 30 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Description Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.
Title Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Apache Mina Sshd
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-09-30T14:31:21.957Z

Reserved: 2026-09-19T13:17:40.308Z

Link: CVE-2026-93996

cve-icon Vulnrichment

Updated: 2026-09-30T10:14:12.492Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T10:17:17.740

Modified: 2026-09-30T16:13:13.493

Link: CVE-2026-93996

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T12:00:16Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling