Threats Tagged 'ghsa-mf93-r5x4-wxqr'

CVE-2026-94002 is a high-severity vulnerability in Apache MINA SSHD's sshd-sftp component affecting versions from 0.9.0 up to but not including 2.20.0, and 3.0.0-M1 up to but not including 3.0.0-M6. The issue arises because the SFTP client does not verify that replies correspond to requests it sent, allowing a malicious server to send unsolicited replies that accumulate in memory, potentially exhausting client resources. Upgrading to versions 2.20.0 or 3.0.0-M6 or later mitigates this issue.