Hi,
The following vulnerabilities were published for libmina-sshd-java.
CVE-2026-77185[0]:
| Authentication bypass in sshd-core in Apache MINA SSHD versions
| 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed
| rare) way to implement an SSH server. Apache MINA SSHD is a Java
| library for client- and server-side SSH. In the server part of the
| library, a mechanism to perform "asynchronous authentication"
| exists. A server implemented with Apache MINA SSHD must contain
| explicit code to make use of this feature. The implementation of
| this feature was flawed and could potentially lead to skipping
| checking the signature in public-key or hostbased authentication, or
| returning a wrong result. Users are recommended to upgrade
| to Apache MINA SSHD 2.20.0 or 3.0.0-M6, which fix the logic error
| and which additionally forbid the use of this "asynchronous
| authentication" mechanism with the public-key or hostbased
| authentication schemes: if used, the SSH session will be closed and
| the server will log an entry indicating that asynchronous
| authentication may be used only with password or keyboard-
| interactive authentication.
CVE-2026-93994[1]:
| Apache MINA SSHD is a Java library for client-side and server-side
| SSH. SSH servers can be configured to require multi-authentication
| schemes, for instance two different public keys, not just one. In
| OpenSSH, this would be done by setting in sshd_config
| AuthenticationMethods "publickey,publickey". Apache MINA SSHD
| provides an equivalent configuration mechanism. In Apache MINA
| SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code
| in component sshd-core does not enforce that the two public keys
| presented are different. A user can thus successfully authenticate
| with only one of the two key pairs required by presenting this
| single key twice. This is a partial authentication bypass.
| Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6,
| which fix this issue.
CVE-2026-93995[2]:
| Improper input validation in sshd-git in Apache MINA SSHD, versions
| up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java
| library for client-side and server-side SSH. Component
| org.apache.sshd:sshd-git provides though class GitPgmCommandFactory
| a way to configure an Apache MINA SSHD server such that
| authenticated SSH clients can remotely execute git commands via the
| JGit library on git repositories stored on the server.
| In CVE-2026-58624 this mechanism was restricted to only a few git
| commands, including "git archive" without "--output" or "-o" options
| such that the resulting archive would not be written on the server
| but instead sent back to the client over the SSH connection. The
| fix done for CVE-2026-58624 was insufficient as it missed removing
| the single-argument "-o=file.zip" version of the command
| parameter from the "archive" command. Users are recommended to
| upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
CVE-2026-93996[3]:
| Uncontrolled resource consumption in component ssd-scp in Apache
| MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA
| SSHD is a Java library for client-side and server-side SSH.
| Component sshd-scp of Apache MINA SSHD provides a Java
| implementation of SCP. The SCP command protocol is line-oriented
| with LF-terminated lines. The protocol handler in sshd-scp did not
| impose any limit on the length of such protocol lines. A malicious
| peer just sending a junk command containing a never-ending sequence
| of characters but never a LF would cause the receiver to allocate
| memory to store this whole junk command, exhausting memory and
| crashing the application with an OutOfMemoryError. Users are
| recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this
| issue by enforcing an upper limit on the length of SCP protocol
| lines.
CVE-2026-94002[4]:
| Possible memory exhaustion in SFTP clients (DefaultSftpClient) in
| component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and
| 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for
| client-side and server-side SSH. The sshd-sftp component provides
| support for SFTP. The SFTP client implementation, when receiving
| a reply, did not check that this reply corresponded to a request
| sent earlier. Unsolicited replies would be stored but never
| consumed. A malicious server could keep sending unsolicited replies
| until available memory in the client was exhausted. Users are
| recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this
| issue.
CVE-2026-94029[5]:
| Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0
| and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-
| file-name/check-file-handle extension. Apache MINA SSHD is a Java
| library for client-side and server-side SSH. Using a very small
| "block size" (for instance 256, which is the minimum) on a huge file
| generates many (file size / block size) hashes. The resulting SFTP
| reply message was accumulated fully in memory server-side, which
| could, with a suitably large (possibly sparse) file exhaust the
| server-side memory, taking down the server. Users are
| recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this
| issue by imposing a maximum limit on the size of the reply. Many
| SFTP implementations have a general limit on the size of SFTP
| messages anyway; typically 256kB as in OpenSSH or also in Apache
| MINA SSHD.
CVE-2026-94052[6]:
| A missing check in LdapPasswordAuthenticator in component sshd-ldap
| in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5
| bypassed authentication checks. Apache MINA SSHD is a Java
| library for client-side and server-side SSH. The optional sshd-ldap
| component provides support for integrating password and publickey
| authentication on the server side with an LDAP server. sshd-ldap
| is an optional component. SSH servers implemented with Apache MINA
| SSHD are affected only if they use sshd-ldap and do configure an
| LdapPasswordAuthenticator to be used for password authentication.
| Normal password authentication via the built-in mechanisms in sshd-
| core is _not_ affected by this vulnerability, which concerns only
| LdapPasswordAuthenticator. Users are recommended to upgrade
| affected applications to version 2.20.0 or 3.0.0-M6, which fix this
| issue.
CVE-2026-94053[7]:
| Authentication bypass via LDAP injection in component sshd-ldap in
| Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
| Apache MINA SSHD is a Java library for client-side and server-side
| SSH. The optional sshd-ldap component provides support for
| integrating password and publickey authentication on the server
| side with an LDAP server. sshd-ldap is an optional component.
| SSH servers implemented with Apache MINA SSHD are affected only if
| they use sshd-ldap and do configure it to be used for password of
| public key authentication. Other Apache MINA SSHD servers are not
| affected. Lack of escaping LDAP filter metacharacters enabled
| successful authentication with username "*" and password "*".
| Users are recommended to upgrade affected applications to version
| 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter
| parameters according to RFC 4515.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-77185
https://www.cve.org/CVERecord?id=CVE-2026-77185
[1] https://security-tracker.debian.org/tracker/CVE-2026-93994
https://www.cve.org/CVERecord?id=CVE-2026-93994
[2] https://security-tracker.debian.org/tracker/CVE-2026-93995
https://www.cve.org/CVERecord?id=CVE-2026-93995
[3] https://security-tracker.debian.org/tracker/CVE-2026-93996
https://www.cve.org/CVERecord?id=CVE-2026-93996
[4] https://security-tracker.debian.org/tracker/CVE-2026-94002
https://www.cve.org/CVERecord?id=CVE-2026-94002
[5] https://security-tracker.debian.org/tracker/CVE-2026-94029
https://www.cve.org/CVERecord?id=CVE-2026-94029
[6] https://security-tracker.debian.org/tracker/CVE-2026-94052
https://www.cve.org/CVERecord?id=CVE-2026-94052
[7] https://security-tracker.debian.org/tracker/CVE-2026-94053
https://www.cve.org/CVERecord?id=CVE-2026-94053
Regards,
Salvatore