CVE-2026-94029

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94029", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-19T17:17:00.525Z", "datePublished": "2026-09-30T09:35:51.711Z", "dateUpdated": "2026-09-30T19:42:56.102Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-30T09:35:51.711Z"}, "title": "Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension", "problemTypes": [{"descriptions": [{"description": "CWE-770 Allocation of resources without limits or throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache MINA SSHD", "packageURL": "pkg:maven/org.apache.sshd/sshd-sftp", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "2.20.0", "versionType": "maven"}, {"status": "affected", "version": "3.0.0-M1", "lessThan": "3.0.0-M6", "versionType": "maven"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.sshd:sshd-sftp"}], "descriptions": [{"value": "Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension.\u00a0Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nUsing a very small \"block size\" (for instance 256, which is the minimum) on a huge file generates many (file size / block size) hashes. The resulting SFTP reply message was accumulated fully in memory server-side, which could, with a suitably large\u00a0(possibly sparse)\u00a0file exhaust the server-side memory, taking down the server.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by imposing a maximum limit on the size of the reply. Many SFTP implementations have a general limit on the size of SFTP messages anyway; typically 256kB as in OpenSSH or also in Apache MINA SSHD.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension.&nbsp;Apache MINA SSHD is a Java library for client-side and server-side SSH.</div><div><br></div><div>Using a very small \"block size\" (for instance 256, which is the minimum) on a huge file generates many (file size / block size) hashes. The resulting SFTP reply message was accumulated fully in memory server-side, which could, with a suitably large&nbsp;(possibly sparse)&nbsp;file exhaust the server-side memory, taking down the server.</div><div><br></div>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by imposing a maximum limit on the size of the reply. Many SFTP implementations have a general limit on the size of SFTP messages anyway; typically 256kB as in OpenSSH or also in Apache MINA SSHD."}]}], "references": [{"url": "https://lists.apache.org/thread.html/ytbl4rwby62xl7llm3wp7k975wwdx99t", "tags": ["vendor-advisory"]}], "metrics": [{"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}, {"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Ho1aAs <xxy010605@gmail.com>", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/29/37"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-30T10:14:18.127Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T19:42:43.742304Z", "id": "CVE-2026-94029", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T19:42:56.102Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/29/37"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-30T10:14:18.127Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94029", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T19:42:43.742304Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T19:42:49.955Z"}}], "cna": {"title": "Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ho1aAs <xxy010605@gmail.com>"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache MINA SSHD", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "2.20.0", "versionType": "maven"}, {"status": "affected", "version": "3.0.0-M1", "lessThan": "3.0.0-M6", "versionType": "maven"}], "packageURL": "pkg:maven/org.apache.sshd/sshd-sftp", "packageName": "org.apache.sshd:sshd-sftp", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/ytbl4rwby62xl7llm3wp7k975wwdx99t", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension.\u00a0Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nUsing a very small \"block size\" (for instance 256, which is the minimum) on a huge file generates many (file size / block size) hashes. The resulting SFTP reply message was accumulated fully in memory server-side, which could, with a suitably large\u00a0(possibly sparse)\u00a0file exhaust the server-side memory, taking down the server.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by imposing a maximum limit on the size of the reply. Many SFTP implementations have a general limit on the size of SFTP messages anyway; typically 256kB as in OpenSSH or also in Apache MINA SSHD.", "supportingMedia": [{"type": "text/html", "value": "<div>Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension.&nbsp;Apache MINA SSHD is a Java library for client-side and server-side SSH.</div><div><br></div><div>Using a very small \"block size\" (for instance 256, which is the minimum) on a huge file generates many (file size / block size) hashes. The resulting SFTP reply message was accumulated fully in memory server-side, which could, with a suitably large&nbsp;(possibly sparse)&nbsp;file exhaust the server-side memory, taking down the server.</div><div><br></div>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by imposing a maximum limit on the size of the reply. Many SFTP implementations have a general limit on the size of SFTP messages anyway; typically 256kB as in OpenSSH or also in Apache MINA SSHD.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-30T09:35:51.711Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94029", "state": "PUBLISHED", "dateUpdated": "2026-09-30T19:42:56.102Z", "dateReserved": "2026-09-19T17:17:00.525Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-30T09:35:51.711Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.sshd:sshd-sftp", "packageURL": "pkg:maven/org.apache.sshd/sshd-sftp", "product": "Apache MINA SSHD", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.20.0", "status": "affected", "version": "1.0.0", "versionType": "maven"}, {"lessThan": "3.0.0-M6", "status": "affected", "version": "3.0.0-M1", "versionType": "maven"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension.\u00a0Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nUsing a very small \"block size\" (for instance 256, which is the minimum) on a huge file generates many (file size / block size) hashes. The resulting SFTP reply message was accumulated fully in memory server-side, which could, with a suitably large\u00a0(possibly sparse)\u00a0file exhaust the server-side memory, taking down the server.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by imposing a maximum limit on the size of the reply. Many SFTP implementations have a general limit on the size of SFTP messages anyway; typically 256kB as in OpenSSH or also in Apache MINA SSHD."}], "id": "CVE-2026-94029", "lastModified": "2026-09-30T20:17:37.383", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94029", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T19:42:43.742304Z", "version": "2.0.3"}}]}, "published": "2026-09-30T10:17:18.010", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/ytbl4rwby62xl7llm3wp7k975wwdx99t"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/29/37"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.sshd/sshd-sftp: Apache MINA SSHD: Denial of Service via memory exhaustion in SFTP check-file extension", "id": "2543853", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543853"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Apache MINA SSHD. When processing SSH File Transfer Protocol (SFTP) check-file extensions, the server accumulates file hash verification responses entirely in memory without enforcing a size limit. An authenticated remote attacker can exploit this vulnerability by requesting file verification with a minimal block size on a large file, leading to memory exhaustion and a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. As a temporary workaround, consider implementing resource limits at the OS level (ulimit, cgroups) to prevent a single process from exhausting all available memory, or restrict SFTP access to trusted users only."}, "name": "CVE-2026-94029", "package_state": [{"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Fix deferred", "package_name": "sshd-sftp", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "sshd-sftp", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Out of support scope", "package_name": "sshd-sftp", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "sshd-sftp", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-09-30T09:35:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94029\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94029\nhttps://lists.apache.org/thread.html/ytbl4rwby62xl7llm3wp7k975wwdx99t"], "statement": "A flaw was found in Apache MINA SSHD's SFTP v6 check-file-name and check-file-handle extension implementation. When an authenticated SFTP user specifies a very small block size (for instance 256 bytes, which is the minimum) on a large file, the server generates many hashes equal to (file size / block size). The resulting SFTP reply message is accumulated fully in memory server-side without limits or throttling. An attacker with valid SFTP credentials can exploit this by using a suitably large (possibly sparse) file to exhaust the server's memory, causing a denial of service and taking down the SFTP server.\nRed Hat ships vulnerable versions of Apache MINA SSHD in JBoss Fuse 7 (Extended Lifecycle Support), Konflux Pipeline, Red Hat build of Apache Camel (Quarkus and Spring Boot variants), and Red Hat Integration Service Registry. Fixed version 2.20.0 is available, which addresses this issue by imposing a maximum limit on the size of the reply message.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,2.20.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0-M1,3.0.0-M6)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache MINA SSHD", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "mina_sshd", "vendor": "apache"}], "created": "2026-09-30T10:30:17.146760+00:00", "updated": "2026-09-30T11:30:18.246458+00:00", "vendors": ["apache", "apache$PRODUCT$mina_sshd"]}