Summary
ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation
The SSH protocol parser trusted attacker-controlled length and count fields without first checking that the declared values fit within the containing packet.
When a client connects to a malicious or compromised SSH server, the server can send a small, malformed packet containing an inner field whose declared length is much larger than the packet itself. The Kaitai Struct Java runtime attempts to allocate a byte array using the declared length before it discovers that the input is truncated. A sufficiently large value can therefore cause excessive memory allocation or an uncaught OutOfMemoryError, potentially terminating the application process that uses the library.
Applications that enable SSH agent forwarding have an additional attack path: the connected server can send malformed agent protocol messages containing the same class of oversized inner length.
Details
SSH uses unsigned 32-bit length prefixes for strings and other protocol structures. Before the fix, several Kaitai Struct definitions passed these lengths directly to generated parsing code. For example, the byte-string definition read a uint32 followed by an array of that size without validating the size against the bytes remaining in the current stream.
The SSH transport limits the size of an outer packet, but an inner field in that packet could still declare a length approaching the Java array size limit. The Kaitai runtime allocates the destination array before reading from the bounded input stream. Consequently, an attacker does not need to transmit an equally large packet to trigger the allocation attempt.
Malformed count fields could also cause parsers to attempt an unreasonable number of repeated elements. The fix validates both byte lengths and element counts against the size of their containing stream.
Parsing failures previously surfaced inconsistently as unchecked runtime exceptions. The fixed version converts malformed SSH packets to a transport protocol error and returns an SSH agent failure response for malformed agent requests.
Attack Requirements
For the general SSH packet path:
- A user or application must initiate a connection to an attacker-controlled or compromised SSH server.
- Authentication is not required.
- No optional library feature is required.
- The server only needs to return a malformed SSH packet containing an oversized inner length or count.
For the agent protocol path, SSH agent forwarding must additionally be enabled.
Impact
Successful exploitation can cause excessive heap allocation and loss of availability of the application process. In constrained environments, a single small malicious packet can cause an OutOfMemoryError.
No confidentiality or integrity impact has been demonstrated.
The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to version 0.3.1 or later.
The fix:
- Validates length-prefixed fields against the remaining bytes in their containing Kaitai stream.
- Validates repeated-element counts against the minimum encoded size of each element.
- Validates SSH transport and agent frame lengths and padding constraints.
- Converts malformed SSH packet parsing failures into
TransportException. - Returns
SSH_AGENT_FAILUREfor malformed forwarded-agent requests instead of allowing parser exceptions to escape.
Frequently Asked Questions
- What is CVE-2026-54700? CVE-2026-54700 is a medium-severity improper input validation vulnerability in org.connectbot.sshlib:sshlib (maven), affecting versions <= 0.3.0. No fixed version is listed yet. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
- Which versions of org.connectbot.sshlib:sshlib are affected by CVE-2026-54700? org.connectbot.sshlib:sshlib (maven) versions <= 0.3.0 is affected.
- Is there a fix for CVE-2026-54700? No fixed version is listed for CVE-2026-54700 yet. Monitor the advisory for updates and apply mitigations in the interim.
- Is CVE-2026-54700 exploitable, and should I be worried? Whether CVE-2026-54700 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-54700 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-54700? No fixed version is listed yet. In the interim: Validate all external input against an allowlist of expected values, types, and ranges before processing.