Threats affecting pkg:maven/org.apache.sshd/sshd-scp

CVE-2026-93996 is a vulnerability in Apache MINA SSHD's sshd-scp component that allows uncontrolled resource consumption. The SCP protocol handler did not limit the length of protocol lines, enabling a malicious peer to send a never-ending line without line feed characters. This causes the receiver to allocate excessive memory, potentially leading to an OutOfMemoryError and application crash. Versions up to 2.19.0 and from 3.0.0-M1 to 3.0.0-M5 are affected. Upgrading to versions 2.20.0 or 3.0.0-M6 mitigates the issue by enforcing an upper limit on SCP protocol line length.

A path traversal vulnerability exists in the sshd-scp component of Apache MINA SSHD, allowing malicious senders to write files to arbitrary locations by sending crafted filenames containing paths. This affects applications using unsupported versions prior to 2.0.0 with SCP receive functionality, and applications using sshd-scp in versions 2.0.0 and later. The issue is fixed in Apache MINA SSHD versions 2.19.0 and 3.0.0-M5. Applications not using sshd-scp in versions 2.0.0 and later are not affected.