The vulnerability is a server‑side memory exhaustion flaw in Apache MINA SSHD’s SFTP v6 check‑file‑name/check‑file‑handle extension. When an SFTP client requests a file by specifying a very small block size – such as 256 bytes, the minimum – the server generates a large amount of hash data for each block. The resulting SFTP reply message is accumulated in full memory, so a large or sparsely constructed file can exhaust the server’s heap and cause the SSH daemon to become non‑responsive.

Affected versions are Apache MINA SSHD 1.0.0 through 2.19.0 and the milestone releases 3.0.0‑M1 to 3.0.0‑M5 of the sshd‑sftp component. All releases lacking the limit on reply size are vulnerable.

The CVSS score of 6.5 reflects a moderate severity DoS risk. The EPSS score is not available and the vulnerability is not listed in the KEV catalog, so there is no public evidence of widespread exploitation yet. Attackers would need to connect via SFTP and supply a large file name request with a minimal block size; if successful the server will allocate enough memory to crash or temporarily stop accepting connections. No additional authentication or privileged access is required beyond normal SFTP access.