CVE-2026-93995

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache <br /> MINA SSHD is a Java library for client-side and server-side SSH.<br /> <br /> <br /> <br /> <br /> Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such <br /> that authenticated SSH clients can remotely execute git commands via the JGit library <br /> on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including "git archive" without "--output" or "-o" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.<br /> <br /> <br /> <br /> <br /> The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command.<br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.