CVE-2026-94002

Summary

The flaw allows memory exhaustion in SFTP clients when receiving unsolicited replies from malicious servers, potentially leading to denial of service. This affects Apache MINA SSHD versions 0.9.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5.

Exploitability

Exploitation is relatively straightforward as a malicious server can continuously send unsolicited replies to exhaust client memory, requiring no authentication or privileged access.

Blast radius

The impact could affect any SFTP client using the affected Apache MINA SSHD library, potentially causing widespread service disruption across systems that connect to vulnerable SFTP servers.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.20.0 or 3.0.0-M6 which contain the fix for this memory exhaustion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.