Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54700— ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation

Quick assessment

Affected
connectbot cbssh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ConnectBot SSH 客户端库采用 Kotlin 编写，并使用 Kaitai Struct 和 KStateMachine 实现。在版本 0.3.1 之前，SSH 协议解析器未对攻击者控制的内部字节长度和元素计数进行验证，直接信任这些值并假定它们不超过包含数据包的总长度。恶意或已被攻陷的 SSH 服务器可以返回一个小型但格式错误的报文，其中包含过大的声明字段，导致 Kaitai Struct 的 Java 运行时在检测到截断输入之前，尝试进行大量内存分配或反复解析。通用的传输路径只需建立客户端连接，无需认证

CVSS 6.9 · Medium

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 1

VendorProduct Version RangeStatus
connectbot cbssh < 0.3.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54700

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation
Source: CVE Program / CVE List V5
Vulnerability Description
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
connectbot cbssh < 0.3.1 -

II. Public POCs for CVE-2026-54700

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54700

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54700 (1)

Vendor Advisories for CVE-2026-54700 (1)

Vendor Pages for CVE-2026-54700 (1)

IV. Related Vulnerabilities

Same product: cbssh
Same vendor: connectbot
Same weakness: CWE-20

V. Comments for CVE-2026-54700

No comments yet

Leave a comment