Vulnerabilities

TI-2026-53907 CVE-2026-77185 · GHSA-v223-2p4c-wp64

Apache MINA SSHD: Asynchronous authentication can bypass signature verification

MEDIUM 47

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00403 Published 2026-09-30 Partial fix · 2.20.0, 3.0.0-M6 CWE-305

TI-2026-63253 CVE-2026-93994 · GHSA-qc4p-9828-mv83

Apache MINA SSHD: Repeated-publickey policy bypass on server

LOW 37

Apache MINA SSHD is a Java library for client-side and server-side SSH.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00303 Published 2026-09-30 Partial fix · 2.20.0, 3.0.0-M6 CWE-304

TI-2026-63290 CVE-2026-94053 · GHSA-qrc3-w53g-j8gv

Apache MINA SSHD: LDAP injection in sshd-ldap

MEDIUM 47

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00363 Published 2026-09-30 Fixed in 2.20.0, 3.0.0-M6 CWE-305

TI-2026-63254 CVE-2026-93995 · GHSA-9jwj-xh8m-f4vf

Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server

LOW 28

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00231 Published 2026-09-30 Fixed in 2.20.0, 3.0.0-M6 CWE-20

TI-2026-63255 CVE-2026-93996 · GHSA-6wm4-w8x6-4vvr

Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read

LOW 29

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00321 Published 2026-09-30 Partial fix · 2.20.0, 3.0.0-M6 CWE-770

TI-2026-63260 CVE-2026-94002 · GHSA-mf93-r5x4-wxqr

Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

LOW 39

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00359 Published 2026-09-30 Partial fix · 2.20.0, 3.0.0-M6 CWE-770

TI-2026-63266 CVE-2026-94029 · GHSA-fj5v-qh2p-6v8f

Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

LOW 29

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00321 Published 2026-09-30 Partial fix · 2.20.0, 3.0.0-M6 CWE-770

TI-2026-63289 CVE-2026-94052 · GHSA-wm5x-hv45-v2v6

Apache MINA SSHD: LDAP password authentication ineffective

MEDIUM 47

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00367 Published 2026-09-30 Fixed in 2.20.0, 3.0.0-M6 CWE-304

Vulnerabilities

Filters