{"id":"CVE-2026-94002","published":"2026-09-30T10:17:17.877","lastModified":"2026-09-30T16:13:13.493","description":"Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.\n\n\n\n\nApache \nMINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.\n\n\n\n\nThe SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/x2cb00kh4qvsq145tj2w4g3toy8cybld","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/36","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows memory exhaustion in SFTP clients when receiving unsolicited replies from malicious servers, potentially leading to denial of service. This affects Apache MINA SSHD versions 0.9.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5.","exploitability":"Exploitation is relatively straightforward as a malicious server can continuously send unsolicited replies to exhaust client memory, requiring no authentication or privileged access.","blast_radius":"The impact could affect any SFTP client using the affected Apache MINA SSHD library, potentially causing widespread service disruption across systems that connect to vulnerable SFTP servers.","remediation":"Upgrade to version 2.20.0 or 3.0.0-M6 which contain the fix for this memory exhaustion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sftp","memory-exhaustion","dos"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:12:33.481Z"}}