What’s Vulnerable › Vulnerabilities
CVE-2021-30129: DoS/OOM leak vulnerability in Apache Mina SSHD Server
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-07-12 · updated 2026-06-17
- Weakness: CWE-772
Description
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
Affected products
- Apache Sshd: from 2.0.0 before 2.7.0 — fixed in 2.7.0
- Oracle Corporation Banking Payments: 14.5
- Oracle Corporation Banking Trade Finance: 14.5
- Oracle Corporation Banking Treasury Management: 14.5
- Oracle Communications Cloud Native Core Console: 1.9.0
- Oracle Corporation FLEXCUBE Universal Banking: from 14.0.0 through 14.3.0; 14.5
- Oracle Middleware Common Libraries And Tools: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
- Oracle Corporation OSS Support Tools: 2.12.42
- Oracle Corporation Retail Customer Management and Segmentation Foundation: 18.0, 19.0
How to fix
Upgrade to a fixed version: Apache Sshd 2.7.0. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2021/07/12/1
- https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E
- https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E
- https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E
- https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E
- https://lists.apache.org/thread.html/red01829efa2a8c893c4baff4f23c9312bd938543a9b8658e172b853b%40%3Cannounce.apache.org%3E
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://www.openwall.com/lists/oss-security/2021/07/12/1
- https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E
- https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E
- https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E
Get alerted when CVE-2021-30129 or the next vulnerability affects your stack