CVE-2026-93996: Apache MINA SSHD DOS Vulnerability

CVE-2026-93996 Overview

CVE-2026-93996 is an uncontrolled resource consumption vulnerability in the sshd-scp component of Apache MINA SSHD, a Java library that implements client-side and server-side Secure Shell (SSH). The flaw affects Apache MINA SSHD versions up to 2.19.0 and versions 3.0.0-M1 through 3.0.0-M5. The Secure Copy Protocol (SCP) handler fails to enforce a maximum length on line-feed terminated protocol lines. A malicious peer can send a continuous stream of characters without ever transmitting a line-feed, forcing the receiver to allocate unbounded memory until the Java Virtual Machine (JVM) crashes with an OutOfMemoryError. The issue is categorized under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
An authenticated network peer can crash Apache MINA SSHD applications by exhausting JVM heap memory through malformed SCP protocol lines.

Affected Products

Apache MINA SSHD versions up to and including 2.19.0
Apache MINA SSHD milestone releases 3.0.0-M1 through 3.0.0-M5
Applications embedding the sshd-scp component for SCP transfers

Discovery Timeline

2026-09-30 - CVE-2026-93996 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-93996

Vulnerability Analysis

Apache MINA SSHD provides a pure-Java SSH implementation, and its sshd-scp module implements the legacy Secure Copy Protocol. SCP is a line-oriented protocol in which control messages are terminated by a line feed (LF) character. During protocol negotiation, the receiver reads bytes from the input stream and appends them to an in-memory buffer until it encounters an LF. The protocol handler in vulnerable versions did not impose any upper bound on this buffer. An attacker who controls one end of the SCP session can stream arbitrary bytes indefinitely without ever sending an LF. Each incoming byte causes the receiver to grow its internal buffer, eventually exhausting the available JVM heap and terminating the process with an OutOfMemoryError.

Root Cause

The root cause is missing input validation on protocol line length. The SCP protocol parser accumulates characters into a buffer without applying a maximum size threshold, violating the principle of validating untrusted input size before allocation. This is a classic instance of [CWE-770], where a resource, in this case JVM heap memory, is allocated based on attacker-controlled input without any throttling or cap.

Attack Vector

Exploitation requires network access to an application using the vulnerable sshd-scp component and a valid SSH session, as SCP operates on top of authenticated SSH channels. Once the SCP subsystem is invoked, the attacker sends a stream of non-LF bytes on the SCP channel. The receiver continues buffering until heap exhaustion causes the application to crash. The impact is limited to availability; confidentiality and integrity are not affected. Because SCP can be initiated in either direction, both SSH clients and servers built on Apache MINA SSHD can be targeted depending on the deployment topology.

No public proof-of-concept code is currently referenced for CVE-2026-93996. See the Apache Mailing List Thread and Openwall OSS-Security Update for the vendor advisory details.

Detection Methods for CVE-2026-93996

Indicators of Compromise

Application logs showing java.lang.OutOfMemoryError originating from org.apache.sshd.scp classes or SCP protocol handler stack frames.
Unexpected termination or restart of Java processes hosting Apache MINA SSHD after an SCP session is opened.
SSH sessions that establish an SCP subsystem and then transmit unusually large volumes of data without completing a command exchange.

Detection Strategies

Enable verbose logging on SSH servers using Apache MINA SSHD and alert on repeated JVM crash events tied to the sshd-scp component.
Correlate SSH authentication events with heap-usage metrics from the JVM to identify sessions that trigger rapid memory growth.
Inspect network flow records for SCP channels with abnormally long-lived, high-byte-count transfers that produce no protocol response.

Monitoring Recommendations

Instrument the JVM with heap-usage and garbage-collection metrics, and alert when SCP-related threads consume disproportionate memory.
Monitor process supervisors (systemd, container orchestrators) for repeated restarts of applications embedding Apache MINA SSHD.
Forward SSH and application logs to a centralized log platform to enable correlation between authenticated sessions and denial-of-service symptoms.

How to Mitigate CVE-2026-93996

Immediate Actions Required

Upgrade Apache MINA SSHD to version 2.20.0 or 3.0.0-M6, which enforce an upper limit on SCP protocol line length.
Inventory internal applications and third-party products that bundle Apache MINA SSHD and prioritize patching of internet-exposed instances.
Restrict SCP subsystem access to trusted user accounts and networks until patches are deployed.

Patch Information

The Apache MINA project fixed CVE-2026-93996 by enforcing a maximum length on SCP protocol lines. Users must upgrade to Apache MINA SSHD 2.20.0 (for the 2.x branch) or 3.0.0-M6 (for the 3.x milestone series). Details are published in the Apache Mailing List Thread and the Openwall OSS-Security Update.

Workarounds

Disable the SCP subsystem in the Apache MINA SSHD server configuration if SCP is not required, and rely on SFTP instead.
Place SSH services behind a bastion host or reverse proxy that terminates and inspects SCP traffic, limiting exposure to untrusted networks.
Apply per-user or per-connection JVM resource controls, such as running the service in a container with a strict memory limit, so a crash is contained and auto-restarted.

bash

# Example: pin Apache MINA SSHD to a fixed version in Maven
# Replace vulnerable coordinates with the patched release
# <dependency>
#   <groupId>org.apache.sshd</groupId>
#   <artifactId>sshd-scp</artifactId>
#   <version>2.20.0</version>
# </dependency>
mvn dependency:tree | grep sshd-scp