CLEANSTART-2026-BW15821: Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0

Q: Which tracked software entries are associated with this finding?

The record associates the finding with cleanstart/gradle and cleanstart/apache-nifi. Review their use of the sshd-sftp component and DefaultSftpClient.

Q: Does the record identify a fixed version or a precise affected version range?

No. The supplied information only states “versions 0” and does not provide a fixed version or a complete affected-version range.

Published Nov 8, 2026

Updated

CVE-2026-94002 affects multiple packages. Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/gradle<9.8.2-r0

9.8.2-r0

cleanstart/apache-nifi<2.12.0-r5

2.12.0-r5

cleanstart/gradle<7.6.6-r1

7.6.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/gradle to a version that resolves this vulnerability.
Fixed in 9.8.2-r0
Upgrade
Upgrade cleanstart/apache-nifi to a version that resolves this vulnerability.
Fixed in 2.12.0-r5
Upgrade
Upgrade cleanstart/gradle to a version that resolves this vulnerability.
Fixed in 7.6.6-r1

Event History

Nov 8, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-94002

Frequently Asked Questions

Which tracked software entries are associated with this finding?

The record associates the finding with cleanstart/gradle and cleanstart/apache-nifi. Review their use of the sshd-sftp component and DefaultSftpClient.

Does the record identify a fixed version or a precise affected version range?

No. The supplied information only states “versions 0” and does not provide a fixed version or a complete affected-version range.

CLEANSTART-2026-BW15821: Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which tracked software entries are associated with this finding?

Does the record identify a fixed version or a precise affected version range?

Company

Resources

Contact

Frequently Asked Questions

Which tracked software entries are associated with this finding?

Does the record identify a fixed version or a precise affected version range?