CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-30 · updated 2026-09-30
Weakness: CWE-770

Description

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Affected products

Apache Software Foundation Apache MINA SSHD: from 0.9.0 before 2.20.0; from 3.0.0-M1 before 3.0.0-M6 — fixed in 2.20.0, 3.0.0-M6

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache MINA SSHD 2.20.0, 3.0.0-M6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-94002 or the next vulnerability affects your stack