{
  "cveId": "CVE-2026-93994",
  "url": "https://patchblox.com/security/cve/CVE-2026-93994",
  "summary": "CVE-2026-93994 is fixed in apache-sshd on 1 platform, first by SUSE-SU-2026:4622-1, released November 7, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "apache-sshd: This update for apache-sshd fixes the following issues:\n\n- CVE-2026-77185: Asynchronous authentication can bypass sig...",
  "description": "This update for apache-sshd fixes the following issues:\n\n- CVE-2026-77185: Asynchronous authentication can bypass signature verification (bsc#1283357).\n- CVE-2026-93994: Repeated-publickey policy bypass on server (bsc#1283352).\n- CVE-2026-93995: Remote execution of JGit \u0027archive -o=file.zip\u0027 can write file on the server (bsc#1283350).\n- CVE-2026-93996: Memory exhaustion DoS via unbounded SCP command line read (bsc#1283348).\n- CVE-2026-94002: Memory exhaustion in SFTP client via unsolicited SFTP replies (bsc#1283347).\n- CVE-2026-94029: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension (bsc#1283346).\n- CVE-2026-94052: LDAP password authentication ineffective (bsc#1283345).\n- CVE-2026-94053: LDAP injection in sshd-ldap (bsc#1283344).\n\nChanges for apache-sshd:\n\n- Update to upstream version 2.20.0:\n \u002B GH-656 ChannelPipedInputStream: shrink buffer when emptied\n \u002B GH-906 Fix finding a signature factory for BC ed25519 keys\n \u002B GH-911 Fix server-side SOCKS5 proxy for fragmented and\n pipelined CONNECT requests\n \u002B Allow asynchronous authentication only for password and\n keyboard-interactive authentication schemes\n \u002B Fix authentication requiring multiple public keys\n (server-side)\n \u002B Better argument handling in sshd-git\n \u002B More checks in authentication (server-side)\n \u002B Better SCP command handling\n \u002B SFTP client: simplify response message handling\n \u002B Fix check-file-name/check-file-handle SFTP v6 extension\n \u002B Improve LDAP authentication (sshd-ldap)\n * New Features\n \u002B GH-905 Implement the \u0027from\u0027 and \u0027expiry-time\u0027 options in\n authorized_keys handling in public key authentication (server\n side)",
  "published": "2026-10-12T07:25:50Z",
  "severity": "",
  "epss": 0.00303,
  "epssPercentile": 0.23263,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apache-sshd",
      "release": "sles 15.6",
      "fixedVersion": "2.20.0-150200.5.19.1",
      "fix": "SUSE-SU-2026:4622-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4622-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "apache-sshd",
      "release": "sles 15.7",
      "fixedVersion": "2.20.0-150200.5.19.1",
      "fix": "SUSE-SU-2026:4622-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4622-1",
      "released": "2026-11-07T00:43:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T20:03:11Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}