This vulnerability arises in the DefaultSftpClient implementation of Apache MINA SSHD. The client fails to match incoming SFTP replies to requests that it had previously sent. As a result, unsolicited replies are accepted and stored, filling the process memory indefinitely. An attacker who controls an SFTP server can continually send such replies, causing the client to exhaust available RAM and potentially crash or become unresponsive. This issue is a classic example of a memory exhaustion flaw (CWE‑770) that can lead to denial of service.

Apache MINA SSHD, versions 0.9.0 through 2.19.0 and 3.0.0‑M1 through 3.0.0‑M5.

The CVSS score of 7.5 denotes a high severity risk of exploitation. While the EPSS score is not available, the lack of a KEV listing suggests no confirmed exploitation in the wild yet. Nevertheless, the flaw can be triggered by a malicious SFTP server that sends large numbers of unsolicited responses, making the attack entirely remote once the client connects to such a server. Administrators should consider any environment that uses DefaultSftpClient as high risk until updated.