CVE-2026-93996

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.

• CWE-770

• https://lists.apache.org/thread.html/xwk8vogkpphcpm01hrt9tb6mgnpjzp35
• https://www.openwall.com/lists/oss-security/2026/09/29/35

Published

Sep 30, 2026

Last Modified

Sep 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93990Expat before 2.8.5 fails to validate that a high surrogate i…7.5
• CVE-2026-93991Argo Workflows versions 4.1.0 through 4.1.3 contain an autho…7.7
• CVE-2026-93992Gopeed through 2.0.0-beta.3 contains a path traversal vulner…8.1
• CVE-2026-93993Mistral Vibe before 2.25.5 contains a remote code execution …8.8
• CVE-2026-93994Apache MINA SSHD is a Java library for client-side and serve…8.1
• CVE-2026-93995Improper input validation in sshd-git in Apache MINA SSHD, v…6.5
• CVE-2026-93997A weakness has been identified in SourceCodester Drug Recomm…7.3
• CVE-2026-93999A flaw was found in the OIDC protocol implementation of Keyc…4.2
• CVE-2026-9400A flaw has been found in Edimax BR-6675nD 1.12. This issue a…6.3
• CVE-2026-94000A flaw was found in the Admin REST API of Keycloak, an open-…6.6
• CVE-2026-94001A flaw was found in the Admin REST API of Keycloak, an open-…6.5
• CVE-2026-94002Possible memory exhaustion in SFTP clients (DefaultSftpClien…7.5