Apache MINA SSHD versions >=1.0.0 <2.20.0 and >=3.0.0-M1 <3.0.0-M6 contain a vulnerability (CWE-770) in the sshd-sftp component related to resource allocation without limits or throttling. Specifically, when a very small block size (e.g., 256 bytes) is used on a large file, the server generates many hashes proportional to file size divided by block size. The resulting SFTP reply message is accumulated fully in server memory, which can lead to memory exhaustion and server downtime. The vulnerability is addressed in versions 2.20.0 and 3.0.0-M6 by enforcing a maximum limit on reply size, aligning with typical SFTP message size limits (e.g., 256kB).

The vulnerability can cause server-side memory exhaustion leading to denial of service (DoS) conditions. It does not affect confidentiality or integrity but impacts availability by potentially taking down the server when processing specially crafted SFTP requests with small block sizes on large files.

Users should upgrade Apache MINA SSHD to version 2.20.0 or later, or to 3.0.0-M6 or later, where the issue is fixed by imposing a maximum limit on the size of the SFTP reply message. This fix prevents excessive memory consumption during SFTP operations. No additional mitigation is required if these versions are in use.