This is a patch release for version 2.20.0.

Bug Fixes

• GH-925 Re-allow "none" authentication (regression in 2.20.0)
• GH-927 Fixed a race condition in key exchanges (regression in 2.14.0; narrow race occurring rarely)

New Features

• GH-904 Log local port in ClientSessionImpl.toString() to be able to distinguish multiple sessions to the same host in logs

Potential Compatibility Issues

None.

Major Code Re-factoring

None; this is a patch release.

This is the seventh milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2.

This seventh milestone is a patch release to 3.0.0-M6; it merges 2.20.1 into 3.0.

Version 3 of Apache MINA SSHD is not API compatible with version 2. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested parties to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog since 3.0.0-M6: sshd-3.0.0-M6...sshd-3.0.0-M7

Bug Fixes

• GH-656 ChannelPipedInputStream: shrink buffer when emptied
• GH-906 Fix finding a signature factory for BC ed25519 keys
• GH-911 Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests
• More checks in authentication (server-side)

Security fixes

• Allow asynchronous authentication only for password and keyboard-interactive authentication schemes. Resolves CVE-2026-77185, announced 2026-09-29.
• Fix authentication requiring multiple public keys (server-side). Resolves CVE-2026-93994, announced 2026-09-29.
• Better argument handling in sshd-git. Resolves CVE-2026-93995, announced 2026-09-29.
• Better SCP command handling. Resolves CVE-2026-93996, announced 2026-09-29.
• SFTP client: simplify response message handling. Resolves CVE-2026-94002, announced 2026-09-29.
• Fix check-file-name/check-file-handle SFTP v6 extension (server-side). Resolves CVE-2026-94029, announced 2026-09-29.
• Improve LDAP authentication (sshd-ldap).
  • Resolves CVE-2026-94052, announced 2026-09-29.
  • Resolves CVE-2026-94053, announced 2026-09-29.

New Features

• GH-905 Implement the "from" and "expiry-time" options in authorized_keys handling in public key authentication (server side)

Potential Compatibility Issues

None.

Major Code Re-factoring

None.

This is the sixth milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2.

This sixth milestone merges 2.20.0 into 3.0, bringing in the improvements done in the 2.x main stream. Besides that, there is one bug fix:

• GH-909 Fix KexOutputHandler self-deadlock during shutdown (regression since 3.0.0-M1)

and one minor new feature:

• HttpProxyConnector: handle fragmented responses from the proxy

Version 3 of Apache MINA SSHD is not API compatible with version 2. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested parties to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog since 3.0.0-M5: sshd-3.0.0-M5...sshd-3.0.0-M6

Bug Fixes

• GH-899 Fix ProcessShellFactory on Linux
• GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces)
• Limit size of decompressed SSH packets
• Escape newlines in filenames in the SCP protocol

Security Fixes

• Validate file names in SCP. Resolves CVE-2026-56452, announced 2026-07-20.
• Improve handling of repository paths in sshd-git on Windows. Resolves CVE-2026-56623, announced 2026-07-20.
• Improve checking SSH user certificates in public-key authentication. Resolves CVE-2026-56624, announced 2026-07-20.
• Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git. Resolves CVE-2026-58624, announced 2026-07-20.

Potential Compatibility Issues

Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git

Bundle sshd-git contains a GitPgmCommandFactory that can be configured for an Apache MINA SSHD server.
It enables remote execution of git commands via JGit.

However, running arbitrary git commands remotely is an exotic use case, and some commands (like
git archive --format zip --output somefile.zip or also git clone or git checkout) could even create
files on the server. This should be only allowed in an OS-level chrooted environment, which Apache MINA
SSHD does not and cannot provide.

We have therefore limited the available commands to a small set of whitelisted git commands that might
be useful as maintenance commands for authorized power users on a git server implemented based on sshd-git.
The command are: archive, blame, branch, describe, diff, gc, log, reflog, show, and status.
All these commands can be executed from a client via git --git-dir <repo> <command> <args>, where <repo>
is the server-side name of the git repository (its local path on the server relative to the configured
root), <command> is the command name (e.g., archive) and <args> are the command arguments. Results are
sent back via the command output streams (output or error streams) and are thus sent back to the client.
For the archivecommand, the --output (or -o) argument is ignored; the archive is always returned via
the command's output stream and this is also sent to the client.

Applications that might have relied on the ability to run other JGit command remotely may no longer work.
Either implement your own dedicated command factory to enable accesss to certain commands, or set the
property GitModuleProperties.RESTRICT_COMMANDS to false on the server-side SshServer (for all sessions)
or on particular ServerSessions (for particular individual sessions) to re-enable access to all commands
supported by JGit.

This is the fifth milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2.

This fifth milestone just merges 2.19.0 into 3.0, bringing in the improvements done in the 2.x main stream.

Version 3 of Apache MINA SSHD is not API compatible with version 2. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested parties to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog since 3.0.0-M4: sshd-3.0.0-M4...sshd-3.0.0-M5

Bug Fixes

• GH-743 Ensure the Java ServiceLoader use a singleton SftpFileSystemProvider
• GH-879 Close SSH channel gracefully on exception in port forwarding
• Security: Improve handling of repository paths in sshd-git. Resolves CVE-2026-48827, announced 2026-05-30.

New Features

• GH-892 Align handling certificates without principals with OpenSSH 10.3

Wildcard principals in host certificates are handled now.

• Putty keys with non-ASCII passphrases

The passphrase needs to be converted to a byte sequence to compute a decryption key for an encrypted private key. This conversion depends on the character encoding. Putty on Windows uses the ANSI codepage set when the key was generated. Apache MINA SSHD now tries multiple encodings in sequence: UTF-8, then the OS encoding, and finally ISO-8859-1 as a last-chance fallback.

Potential Compatibility Issues

• GH-892 Align handling certificates without principals with OpenSSH 10.3

OpenSSH 10.3 changed the way such certificates are handled; see the OpenSSH 10.3 release notes. In Apache MINA SSHD, there is a new flag CoreModuleProperties.ALLOW_EMPTY_CERTIFICATE_PRINCIPALS (by default false) that can be set on an SshClient or SshServer or also on a Session directly. If the value is false, certificates without principals are rejected as in OpenSSH 10.3; if it is true, such certificates are considered to match any user or host name as in OpenSSH < 10.3.

Set the flag on an SshClient or ClientSession to determine the handling of host certificates. Set it on an SshServer or ServerSession to govern the handling of user certificates.

This is the fourth milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2.

This fourth milestone just merges 2.18.0 into 3.0, bringing in the improvements done in the 2.x main stream.

Version 3 of Apache MINA SSHD is not API compatible with version 2. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested parties to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog since 3.0.0-M3: sshd-3.0.0-M3...sshd-3.0.0-M4

This is the third milestone pre-release on the way to a new major version Apache MINA SSHD 3.0.0.

Like regular releases it is available in Maven Central and in the Apache repositories; the Apache source release is also at the usual location.

See the change notes for what has changed with respect to version 2.

This third milestone fixes two bugs in 3.0.0-M2 and brings the improvements done in the current main 2.x version into 3.0.

Version 3 of Apache MINA SSHD is not API compatible with version 2. API comparison reports and a (very high-level and tentative) roadmap are available on the 3.0.0 development website.

This pre-release has passed all our quality and regression tests, just like any other release. We encourage interested parties to try this pre-release. Be aware that APIs might change in future milestone pre-releases.

Full Changelog since 3.0.0-M2: sshd-3.0.0-M2...sshd-3.0.0-M3

This patch release fixes the broken Maven deployment of 2.17.0. (The root pom was missing).

There were no code changes, only a pom update to work around a tooling bug that caused the problem with 2.17.0:

• GH-875 Use Apache Parent POM 36

For the real changes since version 2.16.0 see the 2.17.0 change notes.