CVE-2021-30129
DoS/OOM leak vulnerability in Apache Mina SSHD Server
6.5 MediumFix available
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
3.05%Up 2.0 points since Jul 13, 2021
What each source reports
NVD Score used
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
- Record
CVE-2021-30129- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-772
- Updated
- 2026-11-02
CVE List No score
DoS/OOM leak vulnerability in Apache Mina SSHD Server
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
- Record
CVE-2021-30129- Updated
- 2026-11-02
EUVDEUVD-2021-1649 No score
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
- Record
EUVD-2021-1649- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9279-7hph-r3xw
Buffer Overflow in Apache Mina SSHD
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
- Record
GHSA-9279-7hph-r3xw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-02
OSV
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
- Record
CVE-2021-30129- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-9279-7hph-r3xw
Buffer Overflow in Apache Mina SSHD
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
- Record
GHSA-9279-7hph-r3xw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-02
OSVOESA-2021-1312
apache-sshd security update
Apache SSHD is a 100% pure java library to support the SSH protocols on both the client and server side.
Security Fix(es):
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0(CVE-2021-30129)
- Record
OESA-2021-1312- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4676
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7
- Record
RHSA-2021:4676- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4677
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8
- Record
RHSA-2021:4677- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
- apache sshd
- apache software foundation mina sshd
- oracle banking payments
- oracle banking trade finance
- oracle banking treasury management
- oracle communications cloud native core console
- oracle flexcube universal banking
- oracle middleware common libraries and tools
- oracle oss support tools
- oracle retail customer management and segmentation foundation
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.sshd:sshd-minaMaven |
2.0.0 up to 2.7.0 | 2.7.0 |
org.apache.sshd:sshd-coreMaven |
2.0.0 up to 2.7.0 | 2.7.0 |
org.apache.sshd:sshd-minaMaven |
2.0.0 up to 2.7.0, plus listed versions 2.1.02.2.02.3.02.4.02.5.02.5.12.6.0 |
2.7.0 |
org.apache.sshd:sshd-coreMaven |
2.0.0 up to 2.7.0, plus listed versions 2.1.02.2.02.3.02.4.02.5.02.5.12.6.0 |
2.7.0 |
apache-sshdopenEuler:20.03-LTS-SP1 |
before 2.2.0-2.oe1 | 2.2.0-2.oe1 |
apache-sshdopenEuler:20.03-LTS-SP2 |
before 2.2.0-2.oe1 | 2.2.0-2.oe1 |
eap7-undertowRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:2.2.12-2.Final_redhat_00001.1.el7eap | 0:2.2.12-2.Final_redhat_00001.1.el7eap |
eap7-wildflyRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:7.4.2-2.GA_redhat_00002.1.el7eap | 0:7.4.2-2.GA_redhat_00002.1.el7eap |
eap7-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:7.4.2-2.GA_redhat_00002.1.el7eap | 0:7.4.2-2.GA_redhat_00002.1.el7eap |
eap7-wildfly-java-jdk8Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:7.4.2-2.GA_redhat_00002.1.el7eap | 0:7.4.2-2.GA_redhat_00002.1.el7eap |
Show 48 moreShow less
| Package | Affected | Fixed |
|---|---|---|
eap7-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:7.4.2-2.GA_redhat_00002.1.el7eap | 0:7.4.2-2.GA_redhat_00002.1.el7eap |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:7.4.2-2.GA_redhat_00002.1.el7eap | 0:7.4.2-2.GA_redhat_00002.1.el7eap |
eap7-resteasyRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-cdiRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-clientRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-cryptoRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jackson-providerRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jaxrsRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jettison-providerRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jose-jwtRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jsapiRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-json-binding-providerRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-rxjava2Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-springRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-validator-provider-11Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-yaml-providerRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el7eap | 0:3.15.2-1.Final_redhat_00001.1.el7eap |
eap7-apache-sshdRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:2.7.0-1.redhat_00001.1.el7eap | 0:2.7.0-1.redhat_00001.1.el7eap |
eap7-jsoupRed Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 5 CVEs |
before 0:1.14.2-1.redhat_00002.1.el7eap | 0:1.14.2-1.redhat_00002.1.el7eap |
eap7-undertowRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:2.2.12-2.Final_redhat_00001.1.el8eap | 0:2.2.12-2.Final_redhat_00001.1.el8eap |
eap7-wildflyRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:7.4.2-2.GA_redhat_00002.1.el8eap | 0:7.4.2-2.GA_redhat_00002.1.el8eap |
eap7-wildfly-javadocsRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:7.4.2-2.GA_redhat_00002.1.el8eap | 0:7.4.2-2.GA_redhat_00002.1.el8eap |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:7.4.2-2.GA_redhat_00002.1.el8eap | 0:7.4.2-2.GA_redhat_00002.1.el8eap |
eap7-resteasyRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-cdiRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-clientRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-cryptoRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-jackson-providerRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-jaxrsRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-jettison-providerRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-jose-jwtRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-jsapiRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-json-binding-providerRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-rxjava2Red Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-springRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-validator-provider-11Red Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-resteasy-yaml-providerRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:3.15.2-1.Final_redhat_00001.1.el8eap | 0:3.15.2-1.Final_redhat_00001.1.el8eap |
eap7-apache-sshdRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:2.7.0-1.redhat_00001.1.el8eap | 0:2.7.0-1.redhat_00001.1.el8eap |
eap7-jsoupRed Hat:jboss_enterprise_application_platform:7.4::el8 From an advisory covering 5 CVEs |
before 0:1.14.2-1.redhat_00002.1.el8eap | 0:1.14.2-1.redhat_00002.1.el8eap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-30129 is a medium vulnerability (CVSS 6.5) in Apache Sshd, published July 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.05%, the 87th percentile. Fixed in org.apache.sshd:sshd-mina 2.7.0.
References
lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E
openwall.com/lists/oss-security/2021/07/12/1
oracle.com/security-alerts/cpuapr2022.html
nvd.nist.gov/vuln/detail/CVE-2021-30129
Show 53 moreShow less
issues.apache.org/jira/browse/SSHD-1125
github.com/advisories/GHSA-9279-7hph-r3xw
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1312
access.redhat.com/errata/RHSA-2021:4676
bugzilla.redhat.com/show_bug.cgi?id=1935927
issues.redhat.com/browse/JBEAP-21308
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4676.json
cve.org/CVERecord?id=CVE-2021-3629