Threats Tagged 'ghsa-fj5v-qh2p-6v8f'

CVE-2026-94029 is a server-side memory exhaustion vulnerability in Apache MINA SSHD affecting versions from 1.0.0 up to but not including 2.20.0 and from 3.0.0-M1 up to but not including 3.0.0-M6. The flaw exists in the sshd-sftp component during the SFTP v6 check-file-name/check-file-handle extension. Using a very small block size on a large file causes the server to accumulate a large reply message fully in memory, potentially exhausting server memory and causing a denial of service. The issue is fixed in versions 2.20.0 and 3.0.0-M6 by imposing a maximum limit on the size of the reply message.