CVE-2026-94002

Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

Published Sep 30, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.

Apache
MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.

The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Analysis

Technical impact

This vulnerability arises in the DefaultSftpClient implementation of Apache MINA SSHD. The client fails to match incoming SFTP replies to requests that it had previously sent. As a result, unsolicited replies are accepted and stored, filling the process memory indefinitely. An attacker who controls an SFTP server can continually send such replies, causing the client to exhaust available RAM and potentially crash or become unresponsive. This issue is a classic example of a memory exhaustion flaw (CWE‑770) that can lead to denial of service.

Affected Systems

Apache MINA SSHD, versions 0.9.0 through 2.19.0 and 3.0.0‑M1 through 3.0.0‑M5.

Risk and Exploitability

The CVSS score of 7.5 denotes a high severity risk of exploitation. While the EPSS score is not available, the lack of a KEV listing suggests no confirmed exploitation in the wild yet. Nevertheless, the flaw can be triggered by a malicious SFTP server that sends large numbers of unsolicited responses, making the attack entirely remote once the client connects to such a server. Administrators should consider any environment that uses DefaultSftpClient as high risk until updated.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache MINA SSHD

unaffected

Version	Status	Constraints
`0.9.0`	affected	< 2.20.0
`3.0.0-M1`	affected	< 3.0.0-M6

No data.

Vendor Product Versions

Apache

Mina Sshd

Version	Status	Scheme	Platform
`[0.9.0,2.20.0)`	affected	semver	—
`[3.0.0-M1,3.0.0-M6)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache MINA SSHD to version 2.20.0 or later 3.0.0‑M6, which includes the fix for memory exhaustion in the SFTP client.
Restart any services or applications that load the updated library to ensure the new code is active.
Enable monitoring or alerts on the SFTP client process to detect abnormal memory consumption and respond before a denial of service occurs.

Generated by OpenCVE AI on September 30, 2026 at 11:50 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.359% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/09/29/36
https://lists.apache.org/thread.html/x2cb00kh4qvsq145tj2w4g3toy8cybld
https://nvd.nist.gov/vuln/detail/CVE-2026-94002
https://www.cve.org/CVERecord?id=CVE-2026-94002

History

Oct 1, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-94002 https://www.cve.org/CVERecord?id=CVE-2026-94002
Metrics	threat_severity `None`	threat_severity `Important`

Sep 30, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 30, 2026 1:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache mina Sshd
Vendors & Products		Apache Apache mina Sshd

Sep 30, 2026 11:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/09/29/36

Sep 30, 2026 10:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
Title		Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
Weaknesses		CWE-770
References		https://lists.apache.org/thread.html/x2cb00kh4qvsq145tj2w4g3toy8cybld
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`