https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 13:34:04 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-54700 <p>ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.</p> <p>ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-54700 https://db.gcve.eu/vuln/ghsa-ch3q-cw5r-f4hg <p><strong>Affected:</strong> Maven: org.connectbot.sshlib:sshlib</p> <p>## Summary</p> <p>The SSH protocol parser trusted attacker-controlled length and count fields without first checking that the declared values fit within the containing packet.</p> <p>When a client connects to a malicious or compromised SSH server, the server can send a small, malformed packet containing an inner field whose declared length is much larger than the packet itself. The Kaitai Struct Java runtime attempts to allocate a byte array using the declared length before it discovers that the input is truncated. A sufficiently large value can therefore cause excessive memory allocation or an uncaught `OutOfMemoryError`, potentially terminating the application process that uses the library.</p> <p>Applications that enable SSH agent forwarding have an additional attack path: the connected server can send malformed agent protocol messages containing the same class of oversized inner length.</p> <p>## Details</p> <p>SSH uses unsigned 32-bit length prefixes for strings and other protocol structures. Before the fix, several Kaitai Struct definitions passed these lengths directly to generated parsing code. For example, the byte-string definition read a `uint32` followed by an array of that size without validating the size against the bytes remaining in the current stream.</p> <p>The SSH transport limits the size of an outer packet, but an inner field in that packet could still declare a length approaching the Java array size limit. The Kaitai runtime allocates the destination array before reading from the bounded…</p> <p><strong>Affected:</strong> Maven: org.connectbot.sshlib:sshlib</p> <p>## Summary</p> <p>The SSH protocol parser trusted attacker-controlled length and count fields without first checking that the declared values fit within the containing packet.</p> <p>When a client connects to a malicious or compromised SSH server, the server can send a small, malformed packet containing an inner field whose declared length is much larger than the packet itself. The Kaitai Struct Java runtime attempts to allocate a byte array using the declared length before it discovers that the input is truncated. A sufficiently large value can therefore cause excessive memory allocation or an uncaught `OutOfMemoryError`, potentially terminating the application process that uses the library.</p> <p>Applications that enable SSH agent forwarding have an additional attack path: the connected server can send malformed agent protocol messages containing the same class of oversized inner length.</p> <p>## Details</p> <p>SSH uses unsigned 32-bit length prefixes for strings and other protocol structures. Before the fix, several Kaitai Struct definitions passed these lengths directly to generated parsing code. For example, the byte-string definition read a `uint32` followed by an array of that size without validating the size against the bytes remaining in the current stream.</p> <p>The SSH transport limits the size of an outer packet, but an inner field in that packet could still declare a length approaching the Java array size limit. The Kaitai runtime allocates the destination array before reading from the bounded…</p> https://db.gcve.eu/vuln/ghsa-ch3q-cw5r-f4hg