Threats affecting pkg:maven/Apache Software Foundation/org.apache.sshd:sshd-sftp

CVE-2026-94002 is a high-severity vulnerability in Apache MINA SSHD's sshd-sftp component affecting versions from 0.9.0 up to but not including 2.20.0, and 3.0.0-M1 up to but not including 3.0.0-M6. The issue arises because the SFTP client does not verify that replies correspond to requests it sent, allowing a malicious server to send unsolicited replies that accumulate in memory, potentially exhausting client resources. Upgrading to versions 2.20.0 or 3.0.0-M6 or later mitigates this issue.

CVE-2026-94029 is a server-side memory exhaustion vulnerability in Apache MINA SSHD affecting versions from 1.0.0 up to but not including 2.20.0 and from 3.0.0-M1 up to but not including 3.0.0-M6. The flaw exists in the sshd-sftp component during the SFTP v6 check-file-name/check-file-handle extension. Using a very small block size on a large file causes the server to accumulate a large reply message fully in memory, potentially exhausting server memory and causing a denial of service. The issue is fixed in versions 2.20.0 and 3.0.0-M6 by imposing a maximum limit on the size of the reply message.