Apache MINA SSHD's sshd-scp component implements the SCP protocol, which is line-oriented with LF-terminated lines. The vulnerability arises because the protocol handler did not impose any limit on the length of these lines. A malicious peer can exploit this by sending a continuous stream of characters without a line feed, causing the receiver to allocate memory indefinitely to store the input. This uncontrolled resource consumption leads to memory exhaustion and crashes the application with an OutOfMemoryError. The flaw affects versions up to 2.19.0 and 3.0.0-M1 through 3.0.0-M5. The fix, introduced in versions 2.20.0 and 3.0.0-M6, enforces an upper limit on the length of SCP protocol lines to prevent this condition.

The vulnerability results in denial of service via application crash due to memory exhaustion (OutOfMemoryError). There is no impact on confidentiality or integrity. The attack requires at least low privileges (PR:L) and network access. The CVSS score is 6.5 (medium severity) reflecting the availability impact.

Users should upgrade Apache MINA SSHD to version 2.20.0 or later, or 3.0.0-M6 or later, where the vulnerability is fixed by enforcing an upper limit on SCP protocol line length. No other mitigation is indicated or required.