CVE-2026-54700

Deferred Deferred - Pending Action

Denial of Service in ConnectBot SSH Client Library

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-54700

EUVD

EUVD-2026-98838

Affected Vendors & Products

Vendor	Product	Version / Range
connectbot	cbssh	< 0.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is in the ConnectBot SSH Client Library, which is written in Kotlin. The issue occurs because the library trusts attacker-controlled byte lengths and element counts in SSH packets without verifying they fit within the containing packet. A malicious SSH server can send a small malformed packet with oversized declarations, causing the library to attempt excessive memory allocation or repeated parsing before detecting the truncation. This can lead to an OutOfMemoryError and terminate the application process.

Detection Guidance

Detecting this vulnerability requires checking the version of ConnectBot SSH Client Library in use. Commands like 'adb shell dumpsys package | grep cbssh' for Android or inspecting installed packages on other systems can help identify if an outdated version (<0.3.1) is present. Monitor for application crashes due to OutOfMemoryError during SSH sessions.

Impact Analysis

The vulnerability can cause an application crash due to excessive memory allocation, resulting in an OutOfMemoryError. This impacts availability by terminating the application process. No confidentiality or integrity impact has been demonstrated. Exploitation requires a client connection to a malicious or compromised SSH server but no authentication or special privileges.

Compliance Impact

This vulnerability primarily impacts system availability by causing excessive memory allocation leading to application termination. It does not demonstrate confidentiality or integrity impact, meaning no direct data exposure or modification occurs. Compliance with standards like GDPR or HIPAA typically requires ensuring system availability and protecting data integrity and confidentiality. Since this issue only affects availability without compromising data security, its impact on compliance is likely minimal unless system downtime violates specific availability requirements in those standards.

Mitigation Strategies

Immediately upgrade ConnectBot SSH Client Library to version 0.3.1 or later. Disable SSH agent forwarding if not required. Ensure all SSH client applications using this library are updated to prevent potential memory exhaustion attacks.

Hi! I’m here to help you understand CVE-2026-54700. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70