Every CVE Search/ Get API key

CVE-2026-93996

Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read

6.5 Medium

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.

Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.32%Down 0.1 points since Sep 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.

Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.

Record
CVE-2026-93996
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-89754 6.5

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.

Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.

Record
EUVD-2026-89754
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6wm4-w8x6-4vvr 6.5

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0...

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.

Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.

Record
GHSA-6wm4-w8x6-4vvr
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
NVD 6.5

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.

Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.

Record
CVE-2026-93996
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2026-93996 6.5

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.

Record
DEBIAN-CVE-2026-93996
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-93996 6.5

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.

Record
UBUNTU-CVE-2026-93996
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:11940-1 No score

apache-sshd-2.20.0-1.1 on GA media

These are all security issues fixed in the apache-sshd-2.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11940-1
Updated
2026-11-02
OSVSUSE-SU-2026:4622-1 No score

Security update for apache-sshd

This update for apache-sshd fixes the following issues:

  • CVE-2026-77185: Asynchronous authentication can bypass signature verification (bsc#1283357).
  • CVE-2026-93994: Repeated-publickey policy bypass on server (bsc#1283352).
  • CVE-2026-93995: Remote execution of JGit 'archive -o=file.zip' can write file on the server (bsc#1283350).
  • CVE-2026-93996: Memory exhaustion DoS via unbounded SCP command line read (bsc#1283348).
  • CVE-2026-94002: Memory exhaustion in SFTP client via unsolicited SFTP replies (bsc#1283347).
  • CVE-2026-94029: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension (bsc#1283346).
  • CVE-2026-94052: LDAP password authentication ineffective (bsc#1283345).
  • CVE-2026-94053: LDAP injection in sshd-ldap (bsc#1283344).

Changes for apache-sshd:

  • Update to upstream version 2.20.0:
  • GH-656 ChannelPipedInputStream: shrink buffer when emptied
  • GH-906 Fix finding a signature factory for BC ed25519 keys
  • GH-911 Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests
  • Allow asynchronous authentication only for password and keyboard-interactive authentication schemes
  • Fix authentication requiring multiple public keys (server-side)
  • Better argument handling in sshd-git
  • More checks in authentication (server-side)
  • Better SCP command handling
  • SFTP client: simplify response message handling
  • Fix check-file-name/check-file-handle SFTP v6 extension
  • Improve LDAP authentication (sshd-ldap)
  • New Features
  • GH-905 Implement the 'from' and 'expiry-time' options in authorized_keys handling in public key authentication (server side)
Record
SUSE-SU-2026:4622-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmina-sshd-java
Debian:13
 All versions, plus listed versions
2.13.2-22.13.2-3
 None known
libmina-sshd-java
Debian:14
 All versions, plus listed versions
2.13.2-22.13.2-3
 None known
apache-sshd
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
apache-sshd
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
mina
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-11
 None known
mina2
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.7+dfsg-22.0.9-12.0.9-2
 None known
mina
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-111.1.7.dfsg-12
 None known
mina2
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.16-2
 None known
mina
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-13
 None known
mina2
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.0.19-2
 None known
mina
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-13
 None known
mina2
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.1.4-22.1.5-12.1.5-1ubuntu0.1~esm1
 None known
mina
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-131.1.7.dfsg-13ubuntu1
 None known
mina2
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.2.1-32.2.1-3ubuntu0.1~esm1
 None known
mina2
Ubuntu:26.10
 All versions, plus listed versions
2.2.1-42.2.1-4ubuntu12.2.9-1
 None known
mina2
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.2.1-42.2.1-4ubuntu0.1~esm1
 None known
apache-sshd
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 2.20.0-1.1
2.20.0-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-93996 is a medium vulnerability (CVSS 6.5) in Apache Software Foundation Mina Sshd, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open