{"id":"CVE-2026-93995","aliases":["DEBIAN-CVE-2026-93995","EUVD-2026-89755","GHSA-9jwj-xh8m-f4vf","RHLW-2026-9020b77e982da216","SUSE-SU-2026:4622-1","UBUNTU-CVE-2026-93995","openSUSE-SU-2026:11940-1"],"status":"published","title":"Apache MINA SSHD: Remote execution of JGit \"archive -o=file.zip\" can write file on the server","description":"Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache \nMINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nComponent org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such \nthat authenticated SSH clients can remotely execute git commands via the JGit library \non git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including \"git archive\" without \"--output\" or \"-o\" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.\n\n\n\n\nThe fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument \"-o=file.zip\" version of the command parameter from the \"archive\" command.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00231,"percentile":0.13979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-09-30T09:38:47Z","modified":"2026-10-27T04:00:20Z","fixes":[{"ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.sshd:sshd-git","fixed_in":["2.19.0.rhlw-00003"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"libmina-sshd-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13.2-2","2.13.2-3"]},{"source":"osv","ecosystem":"Debian:14","package":"libmina-sshd-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13.2-2","2.13.2-3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.sshd:sshd-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.0.rhlw-00003"}]}],"versions":["0.12.0","0.13.0","0.14.0","1.0.0","1.1.0","1.1.1","1.2.0","1.3.0","1.4.0","1.6.0","1.7.0","2.0.0","2.1.0","2.10.0","2.11.0","2.12.0","2.12.1","2.13.0","2.13.1","2.13.2","2.14.0","2.15.0","2.16.0","2.17.0","2.17.1","2.18.0","2.19.0","2.2.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1","2.9.2","2.9.3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.5.19.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.7.dfsg-11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mina2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.7+dfsg-2","2.0.9-1","2.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.7.dfsg-11","1.1.7.dfsg-12"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mina2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.16-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.7.dfsg-13"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mina2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.19-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.7.dfsg-13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mina2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.4-2","2.1.5-1","2.1.5-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.7.dfsg-13","1.1.7.dfsg-13ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mina2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-3","2.2.1-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mina2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-4","2.2.1-4ubuntu1","2.2.9-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"mina2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-4","2.2.1-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-1.1"}]}],"bundled":8}],"products":[{"vendor":"apache software foundation","product":"apache mina sshd"}],"references":[{"url":"https://lists.apache.org/thread.html/k13ox2xlry38h9gh6rhmh1d9zs345clk","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93995","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9jwj-xh8m-f4vf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93995","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264622-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283344","tags":["report"]},{"url":"https://bugzilla.suse.com/1283345","tags":["report"]},{"url":"https://bugzilla.suse.com/1283346","tags":["report"]},{"url":"https://bugzilla.suse.com/1283347","tags":["report"]},{"url":"https://bugzilla.suse.com/1283348","tags":["report"]},{"url":"https://bugzilla.suse.com/1283350","tags":["report"]},{"url":"https://bugzilla.suse.com/1283352","tags":["report"]},{"url":"https://bugzilla.suse.com/1283357","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94053","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-93995","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93995","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/29/34","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-93995","title":"Apache MINA SSHD: Remote execution of JGit \"archive -o=file.zip\" can write file on the server","description":"Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache \nMINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nComponent org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such \nthat authenticated SSH clients can remotely execute git commands via the JGit library \non git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including \"git archive\" without \"--output\" or \"-o\" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.\n\n\n\n\nThe fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument \"-o=file.zip\" version of the command parameter from the \"archive\" command.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.","status":"published","published":"2026-09-30T09:38:47.654Z","modified":"2026-09-30T14:30:58.296Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:19:54.50686Z"}],"euvd":[{"id":"EUVD-2026-89755","description":"Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache \nMINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nComponent org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such \nthat authenticated SSH clients can remotely execute git commands via the JGit library \non git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including \"git archive\" without \"--output\" or \"-o\" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.\n\n\n\n\nThe fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument \"-o=file.zip\" version of the command parameter from the \"archive\" command.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.","status":"published","published":"2026-09-30T09:38:47Z","modified":"2026-09-30T14:30:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:49.499669Z"}],"ghsa":[{"id":"GHSA-9jwj-xh8m-f4vf","title":"Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to...","description":"Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache \nMINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nComponent org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such \nthat authenticated SSH clients can remotely execute git commands via the JGit library \non git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including \"git archive\" without \"--output\" or \"-o\" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.\n\n\n\n\nThe fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument \"-o=file.zip\" version of the command parameter from the \"archive\" command.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.","status":"published","published":"2026-09-30T12:35:16Z","modified":"2026-09-30T12:35:21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:12:35.884172Z"}],"nvd":[{"id":"CVE-2026-93995","description":"Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache \nMINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nComponent org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such \nthat authenticated SSH clients can remotely execute git commands via the JGit library \non git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including \"git archive\" without \"--output\" or \"-o\" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.\n\n\n\n\nThe fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument \"-o=file.zip\" version of the command parameter from the \"archive\" command.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.","status":"published","published":"2026-09-30T10:17:17.597Z","modified":"2026-09-30T16:13:13.493Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:52.759595Z"}],"osv":[{"id":"DEBIAN-CVE-2026-93995","description":"Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache  MINA SSHD is a Java library for client-side and server-side SSH.     Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such  that authenticated SSH clients can remotely execute git commands via the JGit library  on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including \"git archive\" without \"--output\" or \"-o\" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.     The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument \"-o=file.zip\" version of the command parameter from the \"archive\" command.     Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.","status":"published","published":"2026-09-30T10:17:17.597Z","modified":"2026-10-01T05:00:53.267333274Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-93995","description":"Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that authenticated SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including \"git archive\" without \"--output\" or \"-o\" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection. The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument \"-o=file.zip\" version of the command parameter from the \"archive\" command. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.","status":"published","published":"2026-09-30T10:17:00Z","modified":"2026-10-17T13:01:18.769601325Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"openSUSE-SU-2026:11940-1","title":"apache-sshd-2.20.0-1.1 on GA media","description":"These are all security issues fixed in the apache-sshd-2.20.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-10-02T18:23:14.062264763Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"RHLW-2026-9020b77e982da216","title":"Lightwell Security Advisory: sshd-git 2.19.0.rhlw-00003","description":"Red Hat Lightwell has released org.apache.sshd:sshd-git 2.19.0.rhlw-00003 with a backported security fix.\n\nThis patched artifact is a drop-in replacement for org.apache.sshd:sshd-git 2.19.0 from Maven Central.","status":"published","published":"2026-10-13T18:33:16Z","modified":"2026-10-27T04:00:20.811529654Z","updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"SUSE-SU-2026:4622-1","title":"Security update for apache-sshd","description":"This update for apache-sshd fixes the following issues:\n\n- CVE-2026-77185: Asynchronous authentication can bypass signature verification (bsc#1283357).\n- CVE-2026-93994: Repeated-publickey policy bypass on server (bsc#1283352).\n- CVE-2026-93995: Remote execution of JGit 'archive -o=file.zip' can write file on the server (bsc#1283350).\n- CVE-2026-93996: Memory exhaustion DoS via unbounded SCP command line read (bsc#1283348).\n- CVE-2026-94002: Memory exhaustion in SFTP client via unsolicited SFTP replies (bsc#1283347).\n- CVE-2026-94029: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension (bsc#1283346).\n- CVE-2026-94052: LDAP password authentication ineffective (bsc#1283345).\n- CVE-2026-94053: LDAP injection in sshd-ldap (bsc#1283344).\n\nChanges for apache-sshd:\n\n- Update to upstream version 2.20.0:\n + GH-656 ChannelPipedInputStream: shrink buffer when emptied\n + GH-906 Fix finding a signature factory for BC ed25519 keys\n + GH-911 Fix server-side SOCKS5 proxy for fragmented and\n pipelined CONNECT requests\n + Allow asynchronous authentication only for password and\n keyboard-interactive authentication schemes\n + Fix authentication requiring multiple public keys\n (server-side)\n + Better argument handling in sshd-git\n + More checks in authentication (server-side)\n + Better SCP command handling\n + SFTP client: simplify response message handling\n + Fix check-file-name/check-file-handle SFTP v6 extension\n + Improve LDAP authentication (sshd-ldap)\n * New Features\n + GH-905 Implement the 'from' and 'expiry-time' options in\n authorized_keys handling in public key authentication (server\n side)\n","status":"published","published":"2026-10-12T07:25:50Z","modified":"2026-10-13T10:30:04.877503172Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}