ConnectBot up to 0.3.0 SSH Protocol Parser input validation

Summaryinfo

A vulnerability was found in ConnectBot up to 0.3.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component SSH Protocol Parser. This manipulation causes input validation. This vulnerability is handled as CVE-2026-54700. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in ConnectBot up to 0.3.0. Affected by this vulnerability is an unknown function of the component SSH Protocol Parser. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. The summary by CVE is:

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-54700 since 06/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.3.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• ConnectBot

Version

• 0.1
• 0.2
• 0.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion