CVE-2026-54697

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54697
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54697.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54697
Aliases
Published
2026-10-13T15:54:48Z
Modified
2026-10-15T02:47:23Z
Severity
  • 6.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing
Details

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-190",
        "CWE-789"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54697.json"
}
References

Affected packages

Git / github.com/connectbot/cbssh

Affected ranges

Type
GIT
Repo
https://github.com/connectbot/cbssh
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2bb917517bec0df229a02ca768d6eae84be72df0
Fixed
f57722866b1526c19ef8937ab0a7f09a5d68c2ad
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.3.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.2.1
v0.*
v0.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54697.json"