Vulnerability · Published Oct 13, 2026 · Assigned by GitHub_M
CVE-2026-54697ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing
Medium 6.7
In plain English
A medium-severity integer overflow in cbssh from connectbot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.connectbot.sshlib:sshlib | no fix listed | GHSA-vc8p-8pxg-rfwg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| connectbot | cbssh | < 0.3.1 |
Weakness: CWE-190, CWE-789 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/connectbot/cbssh/security/advisories/GHSA-vc8p-8pxg-rfwg x_refsource_CONFIRM
- https://github.com/connectbot/cbssh/commit/2bb917517bec0df229a02ca768d6eae84be72df0 x_refsource_MISC
- https://github.com/connectbot/cbssh/releases/tag/v0.3.1 x_refsource_MISC