org.apache.sshd vulnerabilities

Products

• org.apache.sshd/sshd-core 6
• org.apache.sshd/sshd-git 4
• org.apache.sshd/sshd-common 3
• org.apache.sshd/sshd-sftp 3
• org.apache.sshd/sshd-ldap 2
• org.apache.sshd/sshd-scp 2
• org.apache.sshd/sshd-mina 1

Latest org.apache.sshd CVEs

Newest publication first

1. CVE-2026-77185 Apache MINA SSHD: Asynchronous authentication can bypass signature verification

   Published 2026-09-30

   Critical·CVSS 9.1 EPSS 0.55%

   Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanis...

2. CVE-2026-93994 Apache MINA SSHD: Repeated-publickey policy bypass on server

   Published 2026-09-30

   High·CVSS 8.1 EPSS 0.30%

   Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "pub...

3. CVE-2026-94053 Apache MINA SSHD: LDAP injection in sshd-ldap

   Published 2026-09-30

   Critical·CVSS 9.1 EPSS 0.36%

   Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating passwor...

4. CVE-2026-93995 Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server

   Published 2026-09-30

   Medium·CVSS 6.5 EPSS 0.23%

   Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an A...

5. CVE-2026-93996 Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read

   Published 2026-09-30

   Medium·CVSS 6.5 EPSS 0.32%

   Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP...

6. CVE-2026-94002 Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

   Published 2026-09-30

   High·CVSS 7.5 EPSS 0.36%

   Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP....

7. CVE-2026-94029 Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

   Published 2026-09-30

   Medium·CVSS 6.5 EPSS 0.32%

   Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" (fo...

8. CVE-2026-94052 Apache MINA SSHD: LDAP password authentication ineffective

   Published 2026-09-30

   Critical·CVSS 9.1 EPSS 0.37%

   A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provid...

9. CVE-2026-56623 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows

   Published 2026-07-20

   High·CVSS 7.1 EPSS 0.87%

   Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to gi...

10. CVE-2026-56624 Apache MINA SSHD: SSH certificate options lack validations

    Published 2026-07-20

    High·CVSS 7.3 EPSS 0.29%

    Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported fo...

11. CVE-2026-58624 Apache MINA SSHD: Remote execution of JGit commands can write files on the server

    Published 2026-07-20

    Medium·CVSS 5.4 EPSS 0.64%

    Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can r...

12. CVE-2026-56452 Apache MINA SSHD: Path traversal in SCP file reception

    Published 2026-07-20

    High·CVSS 7.5 EPSS 0.77%

    Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send...

13. CVE-2026-48827 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git

    Published 2026-06-01

    High·CVSS 7.1 EPSS 0.53%

    Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications a...

14. CVE-2024-41909 Apache MINA SSHD: integrity check bypass

    Published 2024-08-12

    Medium·CVSS 5.9 EPSS 0.58%

    Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequ...

15. CVE-2023-35887 Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

    Published 2023-07-10

    Medium·CVSS 4.3 EPSS 1.3%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items...

16. CVE-2022-45047 Apache MINA SSHD: Java unsafe deserialization vulnerability

    Published 2022-11-16

    Critical·CVSS 9.8 EPSS 4.7%

    Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for load...

17. CVE-2021-30129 DoS/OOM leak vulnerability in Apache Mina SSHD Server

    Published 2021-07-12

    Medium·CVSS 6.5 EPSS 3.0%

    A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.