VulnerableCode Package Details - pkg:maven/org.apache.sshd/sshd@2.4.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-31an-9pvw-uqf6 Aliases: CVE-2021-30129 GHSA-9279-7hph-r3xw	Missing Release of Resource after Effective Lifetime A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD.	2.7.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-netd-rr9e-wbg5 Aliases: CVE-2022-45047 GHSA-fhw8-8j55-vwgq	Unsafe deserialization in Apache MINA SSHD Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server. Until version 2.1.0, the code affected by this vulnerability appeared in `org.apache.sshd:sshd-core`. Version 2.1.0 contains a [commit](https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0) where the code was moved to the package `org.apache.sshd:sshd-common`, which did not exist until version 2.1.0.	2.9.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-r4e4-u4s6-63gc Aliases: CVE-2023-35887 GHSA-mjmq-gwgm-5qhm	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10	2.9.3 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-31an-9pvw-uqf6
Aliases:
CVE-2021-30129
GHSA-9279-7hph-r3xw

Missing Release of Resource after Effective Lifetime A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD.

2.7.0
Affected by 2 other vulnerabilities.

VCID-netd-rr9e-wbg5
Aliases:
CVE-2022-45047
GHSA-fhw8-8j55-vwgq

Unsafe deserialization in Apache MINA SSHD Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server. Until version 2.1.0, the code affected by this vulnerability appeared in `org.apache.sshd:sshd-core`. Version 2.1.0 contains a [commit](https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0) where the code was moved to the package `org.apache.sshd:sshd-common`, which did not exist until version 2.1.0.

2.9.2
Affected by 1 other vulnerability.

VCID-r4e4-u4s6-63gc
Aliases:
CVE-2023-35887
GHSA-mjmq-gwgm-5qhm

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10

2.9.3
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T22:33:31.953432+00:00	GitLab Importer	Affected by	VCID-r4e4-u4s6-63gc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2023-35887.yml	38.4.0
2026-04-16T22:15:38.547086+00:00	GitLab Importer	Affected by	VCID-netd-rr9e-wbg5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2022-45047.yml	38.4.0
2026-04-16T21:27:27.811376+00:00	GitLab Importer	Affected by	VCID-31an-9pvw-uqf6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2021-30129.yml	38.4.0
2026-04-11T23:52:30.083257+00:00	GitLab Importer	Affected by	VCID-r4e4-u4s6-63gc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2023-35887.yml	38.3.0
2026-04-11T23:32:52.846814+00:00	GitLab Importer	Affected by	VCID-netd-rr9e-wbg5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2022-45047.yml	38.3.0
2026-04-11T22:40:24.304197+00:00	GitLab Importer	Affected by	VCID-31an-9pvw-uqf6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2021-30129.yml	38.3.0
2026-04-02T23:55:41.246959+00:00	GitLab Importer	Affected by	VCID-r4e4-u4s6-63gc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2023-35887.yml	38.1.0
2026-04-02T23:37:59.633792+00:00	GitLab Importer	Affected by	VCID-netd-rr9e-wbg5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2022-45047.yml	38.1.0
2026-04-02T22:50:54.290629+00:00	GitLab Importer	Affected by	VCID-31an-9pvw-uqf6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2021-30129.yml	38.1.0
2026-04-01T18:00:16.015665+00:00	GitLab Importer	Affected by	VCID-netd-rr9e-wbg5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2022-45047.yml	38.0.0
2026-04-01T17:08:54.599560+00:00	GitLab Importer	Affected by	VCID-31an-9pvw-uqf6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd/CVE-2021-30129.yml	38.0.0