https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 19:16:37 +0000 https://vulnerability.circl.lu/vuln/cve-2026-94002 <p><strong>Affected:</strong> Apache Software Foundation Apache MINA SSHD</p> <p>Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.</p> <p>Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.</p> <p>The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.</p> <p>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache MINA SSHD</p> <p>Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.</p> <p>Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.</p> <p>The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.</p> <p>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-94002