CVE-2026-54700: ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ConnectBot SSH Client Libraryto a version that resolves this vulnerability.Fixed in 0.3.1
Event History
Frequently Asked Questions
Which deployments are exposed to the general transport-path issue?
Any client using a version prior to 0.3.1 can be exposed when it connects to a malicious or compromised SSH server. Exploitation requires a client connection, but does not require authentication or any optional feature.
Is SSH agent forwarding required for exploitation?
No. The general SSH transport parsing path is affected without SSH agent forwarding. Agent forwarding is required only for malformed SSH-agent messages.
What is the practical impact of a successful attack?
A malformed packet can cause excessive memory allocation or repeated parsing and trigger an uncaught OutOfMemoryError, terminating the application process. No confidentiality or integrity impact has been demonstrated.
How can this be remediated?
Update ConnectBot SSH Client Library to version 0.3.1, which fixes the issue.