diff --git a/org.eclipse.jgit.ssh.apache/src/org/eclipse/jgit/internal/transport/sshd/JGitKexExtensionHandler.java b/org.eclipse.jgit.ssh.apache/src/org/eclipse/jgit/internal/transport/sshd/JGitKexExtensionHandler.java
index 489c77d..9446aaa 100644
--- a/org.eclipse.jgit.ssh.apache/src/org/eclipse/jgit/internal/transport/sshd/JGitKexExtensionHandler.java
+++ b/org.eclipse.jgit.ssh.apache/src/org/eclipse/jgit/internal/transport/sshd/JGitKexExtensionHandler.java
@@ -129,8 +129,8 @@
 		// such that supported ones are at the front, in client order,
 		// followed by unsupported ones, also in client order.
 		if (serverAlgorithms != null && !serverAlgorithms.isEmpty()) {
-			List<NamedFactory<Signature>> clientAlgorithms = session
-					.getSignatureFactories();
+			List<NamedFactory<Signature>> clientAlgorithms = new ArrayList<>(
+					session.getSignatureFactories());
 			if (log.isDebugEnabled()) {
 				log.debug(
 						"handleServerSignatureAlgorithms({}): PubkeyAcceptedAlgorithms before: {}", //$NON-NLS-1$