CVE-2026-54697

Deferred Deferred - Pending Action

Integer Overflow in ConnectBot SSH Client Library

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-54697

EUVD

EUVD-2026-98839

Affected Vendors & Products

Vendor	Product	Version / Range
connectbot	cbssh	< 0.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-54697 is a memory exhaustion vulnerability in the ConnectBot SSH Client Library. It occurs in the DER private-key parsing functionality where the DerReader.readLength() function accepts excessively long DER length octets. This can lead to integer wraparound or excessive memory allocation when processing attacker-provided private-key files. The issue affects versions prior to 0.3.1.

Detection Guidance

Detecting this vulnerability requires checking the version of ConnectBot SSH Client Library in use. Commands include: 1) For Android systems, check the installed app version via package manager or settings. 2) For library dependencies, inspect build.gradle or dependency manifests for cbssh versions prior to 0.3.1. 3) Monitor application logs for OutOfMemoryError exceptions during private-key parsing operations.

Impact Analysis

This vulnerability can cause application crashes due to OutOfMemoryError if a malicious private-key file is loaded. It may terminate the application process but does not impact confidentiality or integrity of data. Exploitation requires an attacker to provide a specially crafted private-key file.

Compliance Impact

This vulnerability primarily impacts system availability due to potential OutOfMemoryError from excessive memory allocation during DER private-key parsing. It does not directly affect confidentiality or integrity of data, which are key concerns for GDPR and HIPAA. However, prolonged system unavailability could indirectly impact compliance by disrupting access to personal or health data processing systems.

Mitigation Strategies

Immediately upgrade to ConnectBot SSH Client Library version 0.3.1 or later. Remove any untrusted private-key files and avoid loading them from untrusted sources. Implement input validation for DER-encoded private keys before processing. Monitor system resources for abnormal memory usage patterns.

Hi! I’m here to help you understand CVE-2026-54697. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70