https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:59:14 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-93996 <p>Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.</p> <p>Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.</p> <p>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.</p> <p>Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.</p> <p>Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.</p> <p>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-93996 https://vulnerability.circl.lu/vuln/ghsa-6wm4-w8x6-4vvr <p>Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.</p> <p>Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.</p> <p>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.</p> <p>Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.</p> <p>Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.</p> <p>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.</p> https://vulnerability.circl.lu/vuln/ghsa-6wm4-w8x6-4vvr https://vulnerability.circl.lu/vuln/opensuse-su-2026:11940-1 <p>apache-sshd-2.20.0-1.1 on GA media</p> <p>apache-sshd-2.20.0-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11940-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93996 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mina, Ubuntu:16.04:LTS: mina2, Ubuntu:18.04:LTS: mina, Ubuntu:18.04:LTS: mina2, Ubuntu:20.04:LTS: mina, Ubuntu:20.04:LTS: mina2, Ubuntu:22.04:LTS: mina, Ubuntu:Pro:22.04:LTS: mina2, Ubuntu:24.04:LTS: mina, Ubuntu:Pro:24.04:LTS: mina2 and 1 more</p> <p>[Unknown description]</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mina, Ubuntu:16.04:LTS: mina2, Ubuntu:18.04:LTS: mina, Ubuntu:18.04:LTS: mina2, Ubuntu:20.04:LTS: mina, Ubuntu:20.04:LTS: mina2, Ubuntu:22.04:LTS: mina, Ubuntu:Pro:22.04:LTS: mina2, Ubuntu:24.04:LTS: mina, Ubuntu:Pro:24.04:LTS: mina2 and 1 more</p> <p>[Unknown description]</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93996