CVE-2026-58624

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD. The SFTP client implementation did not check that a received reply corresponded to a previously sent request, causing unsolicited replies to be stored but never consumed. A malicious server could send such replies until client memory is exhausted.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the ssd-scp component is vulnerable to uncontrolled resource consumption. The SCP protocol is line-oriented, and the handler did not impose a limit on line length. A malicious peer sending an endless sequence of characters without LF can cause memory allocation and application crash due to OutOfMemoryError.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the sshd-git component has improper input validation. The fix for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command. Authenticated SSH clients can remotely execute git commands, including writing archives on the server.

Apache MINA SSHD allows partial authentication bypass. When the SSH server is configured to require two different public keys, the server code in component sshd-core does not enforce that the presented keys are different. A user can successfully authenticate by presenting the same key twice.

Authentication bypass via LDAP injection in the sshd-ldap component of Apache MINA SSHD. Lack of escaping LDAP filter metacharacters enables successful authentication with username "*" and password "*".

A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD allows bypassing authentication checks. The vulnerability only affects servers using LdapPasswordAuthenticator for password authentication.

Authentication bypass in sshd-core of Apache MINA SSHD. A flaw in the implementation of the "asynchronous authentication" mechanism could potentially lead to skipping signature checks in public-key or hostbased authentication, or returning a wrong result.

The class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD versions up to 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. It is one of several implementations that can be used for loading the host keys of an SSH server.

In Apache MINA SSHD versions 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the sshd-sftp component in the SFTP v6 check-file-name/check-file-handle extension is vulnerable to server-side memory exhaustion. Using a very small block size (e.g., 256) on a huge file generates many hashes, and the SFTP reply is accumulated in memory, potentially crashing the server.

Improper certificate validation in Apache MINA SSHD (server-side). The server did not check for force-command or verify-required options in OpenSSH certificates, allowing an authenticated user to execute other commands than specified. Fixed in versions 2.19.0 and 3.0.0-M5.