Apache Mina Sshd vulnerabilities

7 CVEs affecting Apache Mina Sshd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-58624, published 2026-07-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-6111, published 2019-01-31. Medium severity, CVSS 5.9. EPSS: 58.2% chance of exploitation in the next 30 days. An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only…
CVE-2026-56623, published 2026-07-20. High severity, CVSS 7.1. EPSS: 0.9% chance of exploitation in the next 30 days. Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component…
CVE-2026-48827, published 2026-06-01. High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days. Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to…
CVE-2026-56452, published 2026-07-20. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP…
CVE-2026-58624, published 2026-07-20. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its…
CVE-2024-41909, published 2024-08-12. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop…
CVE-2026-56624, published 2026-07-20. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during…