CVE-2024-41909 Apache MINA SSHD: integrity check bypass

What is CVE-2024-41909?

CVE-2024-41909 is a medium-severity vulnerability in Apache MINA SSHD, published on 12 Aug 2024.

Official description

Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack

The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.

Weakness: CWE-354

Which versions are affected by CVE-2024-41909?

2 open source packages ship an affected version, including org.apache.sshd:sshd-common. It affects 1 product.

Products include Apache Mina Sshd.

How do I fix CVE-2024-41909?

Upgrade org.apache.sshd:sshd-common to 2.12.0 or later.

Is CVE-2024-41909 being exploited?

There is no known exploitation of CVE-2024-41909 in the wild and no public exploit code.

Other vulnerabilities in Apache MINA SSHD

• CVE-2026-56452 Apache MINA SSHD: Path traversal in SCP file reception High 7.5
• CVE-2026-56624 Apache MINA SSHD: SSH certificate options lack validations High 7.3
• CVE-2026-56623 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows High 7.1
• CVE-2026-48827 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git High 7.1
• CVE-2019-6111 Path traversal in n/a Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-HK92541, CLEANSTART-2026-IP32921, CLEANSTART-2026-UA87106, GHSA-2326-hx7g-3m9r, MINI-4rrg-7hvq-2rpr, MINI-mwg3-4prr-r9xm.