CVE-2026-94002
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
30/09/2026
Última modificación:
30/09/2026
Descripción
*** Pendiente de traducción *** Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.<br />
<br />
<br />
<br />
<br />
Apache <br />
MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.<br />
<br />
<br />
<br />
<br />
The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.<br />
<br />
<br />
<br />
<br />
Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
Impacto
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA