DoS/OOM leak vulnerability in Apache Mina SSHD Server
Priority LOW 34CWE-772Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-772.
Summary
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
Why it matters now
EPSS 0.03049 87th percentileScored 2026-11-07
Fix Partial org.apache.sshd:sshd-mina (Maven): 2.7.0org.apache.sshd:sshd-core (Maven): 2.7.0Red Hat: 6 advisoriesRed Hat: 6 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Mina SSHD | 2.0.0 and later | — | No fix listed | CNA |
| — | org.apache.sshd:sshd-mina (Maven) | 2.0.0 to before 2.7.0 | 2.7.0 | Patch available | GHSA-9279-7hph-r3xw |
| — | org.apache.sshd:sshd-core (Maven) | 2.0.0 to before 2.7.0 | 2.7.0 | Patch available | GHSA-9279-7hph-r3xw |
- Apache Mina SSHD VendorApache Affected 2.0.0 and later Fixed in — No fix listed CNA
- org.apache.sshd:sshd-mina (Maven) Vendor— Affected 2.0.0 to before 2.7.0 Fixed in 2.7.0 Patch available GHSA-9279-7hph-r3xw
- org.apache.sshd:sshd-core (Maven) Vendor— Affected 2.0.0 to before 2.7.0 Fixed in 2.7.0 Patch available GHSA-9279-7hph-r3xw
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:sshd:*:*:*:*:*:*:*:* | 2.0.0 to before 2.7.0 | Vulnerable | Apache |
| cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* | 14.0.0 – 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:* | 14.1.1.0.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:sshd:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.7.0 Vulnerable ·Apache
- cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* Versions 14.0.0 – 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:oss_support_tools:2.12.42:*:*:*:*:*:*:* | 2.12.42 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* | 18.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* | 19.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:oss_support_tools:2.12.42:*:*:*:*:*:*:* Versions 2.12.42 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-9279-7hph-r3xw org.apache.sshd:sshd-mina (Maven) Fixed in 2.7.0 Advisory →
- Fix · GHSA-9279-7hph-r3xw org.apache.sshd:sshd-core (Maven) Fixed in 2.7.0 Advisory →
Red Hat 6 advisories
- RHSA-2023:4983 Released 2023-09-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.4 security update
- RHPAM 7.13.4 async
- RHSA-2022:1013 Released 2022-03-22 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus 2.2.1 security update
- RHINT Camel-Q 2.2.1
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
Show 3 more Red Hat advisories
- RHSA-2021:4677 Released 2021-11-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.7.0-1.redhat_00001.1.el8eap, eap7-jsoup-1.14.2-1.redhat_00002.1.el8eap, eap7-resteasy-3.15.2-1.Final_redhat_00001.1.el8eap +22
- RHSA-2021:4676 Released 2021-11-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.7.0-1.redhat_00001.1.el7eap, eap7-jsoup-1.14.2-1.redhat_00002.1.el7eap, eap7-resteasy-3.15.2-1.Final_redhat_00001.1.el7eap +24
- RHSA-2021:4679 Released 2021-11-15 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.2 security update
- Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.12.Final-redhat-00001.jar, org.apache.santuario.xmlsec-2.1.7.redhat-00001.jar, org.apache.sshd.sshd-core-2.7.0.redhat-00001.jar +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| RHINT Camel-Q 2.2.1 | Fixed | RHSA-2022:1013 |
| RHPAM 7.13.4 async | Fixed | RHSA-2023:4983 |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2021:4676 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2021:4677 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2021:4679 |
Not affected: 4 products
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss Enterprise Application Platform
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2021-30129
- 2026-10-03 Alias added: GHSA-9279-7hph-r3xw
References
Advisory 3
Other 5
- [announce] 20210712 CVE-2021-30129: DoS/OOM leak vulnerability in Apache Mina SSHD Server
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://issues.apache.org/jira/browse/SSHD-1125
- https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f@%3Cusers.mina.apache.org%3E
- https://lists.apache.org/thread.html/red01829efa2a8c893c4baff4f23c9312bd938543a9b8658e172b853b@%3Cannounce.apache.org%3E
More Apache Sshd vulnerabilities
- TI-2022-22144 Apache MINA SSHD: Java unsafe deserialization vulnerability CVSS 3.1CRITICAL 9.8
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2023-17957 Apache MINA SSHD: Information disclosure bugs with RootedFilesystem CVSS 3.1MEDIUM 5.0
Sources
- CVE-2021-30129 · CVE Program
- CVE-2021-30129 · NVD
- FIRST EPSS
- GHSA-9279-7hph-r3xw · GitHub Advisory Database · CC BY 4.0
- CVE-2021-30129 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences