Bug 2543859 (CVE-2026-94002)

Summary:	CVE-2026-94002 org.apache.sshd/sshd-sftp: Apache MINA SSHD: Denial of Service via unsolicited SFTP replies
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ewittman, fmariani, fmongiar, gbenhaim, gmalinko, janstey, jnethert, jwon, mcarlett, nipatil, niyer, pantinor, pdelbell, pjindal, rkubis, rstepani, tcunning, twaugh, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the sshd-sftp component of Apache MINA SSHD. This vulnerability allows a malicious server to cause a Denial of Service (DoS) on the client by exhausting system memory. The SFTP (SSH File Transfer Protocol) client fails to verify whether incoming replies correspond to previously sent requests, indefinitely retaining unrequested replies. A rogue server can exploit this by continuously sending unsolicited messages until all available client memory is consumed.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-30 10:10:06 UTC

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.




Apache 
MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.




The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.




Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Comment 1 Jon Orris 2026-10-15 23:26:07 UTC

This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Via RHSA-2026:83670 https://access.redhat.com/errata/RHSA-2026:83670