Overview

Bug Fixes

• GH-656 ChannelPipedInputStream: shrink buffer when emptied
• GH-906 Fix finding a signature factory for BC ed25519 keys
• GH-911 Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests
• More checks in authentication (server-side)

Security fixes

• Allow asynchronous authentication only for password and keyboard-interactive authentication schemes. Resolves CVE-2026-77185, announced 2026-09-29.
• Fix authentication requiring multiple public keys (server-side). Resolves CVE-2026-93994, announced 2026-09-29.
• Better argument handling in sshd-git. Resolves CVE-2026-93995, announced 2026-09-29.
• Better SCP command handling. Resolves CVE-2026-93996, announced 2026-09-29.
• SFTP client: simplify response message handling. Resolves CVE-2026-94002, announced 2026-09-29.
• Fix check-file-name/check-file-handle SFTP v6 extension (server-side). Resolves CVE-2026-94029, announced 2026-09-29.
• Improve LDAP authentication (sshd-ldap).
  • Resolves CVE-2026-94052, announced 2026-09-29.
  • Resolves CVE-2026-94053, announced 2026-09-29.

New Features

• GH-905 Implement the “from” and “expiry-time” options in authorized_keys handling in public key authentication (server side)

Potential Compatibility Issues

None.

Major Code Re-factoring

None.

Getting the Distributions

• Source distributions:
  • Apache Mina SSHD 2.20.0 Sources (.tar.gz) PGP SHA512
  • Apache Mina SSHD 2.20.0 Sources (.zip) PGP SHA512
• Binary distributions:
  • Apache Mina SSHD 2.20.0 Binary (.tar.gz) PGP SHA512
  • Apache Mina SSHD 2.20.0 Binary (.zip) PGP SHA512

PGP signing public keys for all releases are available in the Apache MINA KEYS file.

Please report any feedback to users@mina.apache.org.