CVE-2021-30129

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

No affected versions have been published.

Timeline

Published: Jul 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-30139.8ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--sea CVE-2021-301307.5phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.CVE-2021-301329.8Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.CVE-2021-301336.1A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to CVE-2021-301346.1php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data CVE-2021-301378.2Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the se CVE-2021-301397.5In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.CVE-2021-30146.1In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.CVE-2021-301405.4LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has CVE-2021-301417.5Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an CVE-2021-301444.3The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the las CVE-2021-301457.8A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playli