CVE-2026-54700 in ConnectBot
Summary
by MITRE • 10/13/2026
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The ConnectBot SSH Client Library, implemented using Kotlin alongside Kaitai Struct for data parsing and KStateMachine for state management, contains a critical input validation flaw within its Secure Shell protocol parser prior to version 0.3.1. This vulnerability stems from the library's failure to validate that inner byte lengths and element counts declared by an incoming SSH packet actually fit within the bounds of the containing packet buffer. In standard secure software design, parsers must rigorously verify that all length fields are consistent with the actual data available before attempting any memory allocation or processing operations. By trusting these attacker-controlled values without verification, the application exposes itself to resource exhaustion attacks where a malicious server can manipulate the client's behavior through malformed network traffic.
The technical mechanism of this flaw involves the Kaitai Struct Java runtime attempting excessive memory allocations based on oversized declarations found in the packet headers. When a compromised or malicious SSH server returns a small but malformed packet with inflated length fields, the parser attempts to allocate resources corresponding to these false sizes rather than the actual truncated input present. This discrepancy triggers repeated parsing loops and massive memory consumption as the system struggles to process data that does not exist at the specified scale. The vulnerability is particularly insidious because it can be triggered during general transport path connections without requiring user authentication or optional feature negotiation, meaning any client establishing a connection is potentially susceptible if it processes such malformed packets early in the session lifecycle.
From an operational impact perspective, this flaw primarily results in a denial of service condition rather than a compromise of confidentiality or integrity. The excessive resource consumption leads to an uncaught OutOfMemoryError within the Java Virtual Machine, which subsequently terminates the ConnectBot application process abruptly. While there is no demonstrated risk of data exfiltration or unauthorized modification of stored information, the reliability and availability of the SSH client are significantly compromised. Additionally, specific malformed SSH-agent messages can exploit this flaw under conditions where SSH agent forwarding is enabled, expanding the attack surface to scenarios involving credential delegation through forwarded agents. This aligns with CWE-789, which classifies memory allocation without proper limits on size or count, and relates to ATT&CK technique T1496, Resource Hijacking, specifically via denial of service impacts caused by resource exhaustion.
Mitigation for this vulnerability requires an immediate upgrade to ConnectBot version 0.3.1 or later, where the parsing logic has been corrected to enforce strict bounds checking on all incoming length fields and element counts. Developers integrating this library should ensure that their build pipelines prioritize security patches related to input validation in network protocol parsers. Furthermore, implementing defense-in-depth strategies such as limiting heap size for specific application components can provide a secondary layer of protection against similar resource exhaustion vulnerabilities in other libraries. Organizations relying on ConnectBot for mobile SSH access must verify the version integrity of deployed applications to prevent potential service disruptions caused by malicious server-side exploitation attempts.