CVE-2026-54697 Details
Description
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.
A vulnerability exists in the ConnectBot SSH Client Library, specifically in versions prior to 0.3.1, within the DER parsing functionality of the SSH client library. The issue arises because the DER parser improperly validates length values before converting them to integers and allocating memory. This flaw can be exploited by loading a malicious private key file through various SSH client methods, such as 'authenticatePublicKey', 'decodePemPrivateKey', 'sign', or 'getPublicKey'. The vulnerability can cause integer overflow, excessive memory allocation, and an unhandled 'OutOfMemoryError', potentially crashing the application. However, it is important to note that this vulnerability does not affect the confidentiality or integrity of cryptographic keys, and the SSH server host keys and agent-forwarding messages are not impacted.
Users can update to version 0.3.1 of the ConnectBot SSH Client Library, where this vulnerability has been fixed. The updated version includes a revised DER parser that properly validates length values, rejects invalid encodings, and prevents excessive memory allocation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/connectbot/cbssh/commit/2bb917517bec0df229a02ca768d6eae84be72df0 | [email protected] | Source CodeVendor |
| https://github.com/connectbot/cbssh/releases/tag/v0.3.1 | [email protected] | Release NotesVendor |
| https://github.com/connectbot/cbssh/security/advisories/GHSA-vc8p-8pxg-rfwg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ConnectBot SSH Client Library | < 0.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |