Search
Find a vulnerability
Search criteria
4 vulnerabilities found for cbssh by connectbot
CVE-2026-54700 (GCVE-0-2026-54700)
Vulnerability from nvd – Published: 2026-10-13 15:53 – Updated: 2026-10-16 22:06
VLAI
EPSS
VEX
Title
ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation
Summary
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 22:05 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/connectbot/cbssh/security/advi… | x_refsource_CONFIRM |
| https://github.com/connectbot/cbssh/pull/194 | x_refsource_MISC |
| https://github.com/connectbot/cbssh/commit/a08421… | x_refsource_MISC |
| https://github.com/connectbot/cbssh/releases/tag/v0.3.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| connectbot | cbssh |
Affected:
< 0.3.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54700",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T22:05:55.418262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T22:06:09.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cbssh",
"vendor": "connectbot",
"versions": [
{
"status": "affected",
"version": "\u003c 0.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:53:47.361Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg"
},
{
"name": "https://github.com/connectbot/cbssh/pull/194",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/pull/194"
},
{
"name": "https://github.com/connectbot/cbssh/commit/a08421fbe7cf8b72fa60fb8b2f98fb465dc43fd9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/commit/a08421fbe7cf8b72fa60fb8b2f98fb465dc43fd9"
},
{
"name": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1"
}
],
"source": {
"advisory": "GHSA-ch3q-cw5r-f4hg",
"discovery": "UNKNOWN"
},
"title": "ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54700",
"datePublished": "2026-10-13T15:53:47.361Z",
"dateReserved": "2026-06-15T22:58:06.562Z",
"dateUpdated": "2026-10-16T22:06:09.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54697 (GCVE-0-2026-54697)
Vulnerability from nvd – Published: 2026-10-13 15:54 – Updated: 2026-10-13 16:07
VLAI
EPSS
VEX
Title
ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing
Summary
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:07 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/connectbot/cbssh/security/advi… | x_refsource_CONFIRM |
| https://github.com/connectbot/cbssh/commit/2bb917… | x_refsource_MISC |
| https://github.com/connectbot/cbssh/releases/tag/v0.3.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| connectbot | cbssh |
Affected:
< 0.3.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54697",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:07:40.579697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:07:53.782Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cbssh",
"vendor": "connectbot",
"versions": [
{
"status": "affected",
"version": "\u003c 0.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:54:48.714Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/connectbot/cbssh/security/advisories/GHSA-vc8p-8pxg-rfwg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/connectbot/cbssh/security/advisories/GHSA-vc8p-8pxg-rfwg"
},
{
"name": "https://github.com/connectbot/cbssh/commit/2bb917517bec0df229a02ca768d6eae84be72df0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/commit/2bb917517bec0df229a02ca768d6eae84be72df0"
},
{
"name": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1"
}
],
"source": {
"advisory": "GHSA-vc8p-8pxg-rfwg",
"discovery": "UNKNOWN"
},
"title": "ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54697",
"datePublished": "2026-10-13T15:54:48.714Z",
"dateReserved": "2026-06-15T22:58:06.562Z",
"dateUpdated": "2026-10-13T16:07:53.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54697 (GCVE-0-2026-54697)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:54 – Updated: 2026-10-13 16:07
VLAI
EPSS
VEX
Title
ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing
Summary
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:07 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/connectbot/cbssh/security/advi… | x_refsource_CONFIRM |
| https://github.com/connectbot/cbssh/commit/2bb917… | x_refsource_MISC |
| https://github.com/connectbot/cbssh/releases/tag/v0.3.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| connectbot | cbssh |
Affected:
< 0.3.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54697",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:07:40.579697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:07:53.782Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cbssh",
"vendor": "connectbot",
"versions": [
{
"status": "affected",
"version": "\u003c 0.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:54:48.714Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/connectbot/cbssh/security/advisories/GHSA-vc8p-8pxg-rfwg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/connectbot/cbssh/security/advisories/GHSA-vc8p-8pxg-rfwg"
},
{
"name": "https://github.com/connectbot/cbssh/commit/2bb917517bec0df229a02ca768d6eae84be72df0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/commit/2bb917517bec0df229a02ca768d6eae84be72df0"
},
{
"name": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1"
}
],
"source": {
"advisory": "GHSA-vc8p-8pxg-rfwg",
"discovery": "UNKNOWN"
},
"title": "ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54697",
"datePublished": "2026-10-13T15:54:48.714Z",
"dateReserved": "2026-06-15T22:58:06.562Z",
"dateUpdated": "2026-10-13T16:07:53.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54700 (GCVE-0-2026-54700)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:53 – Updated: 2026-10-16 22:06
VLAI
EPSS
VEX
Title
ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation
Summary
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 22:05 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/connectbot/cbssh/security/advi… | x_refsource_CONFIRM |
| https://github.com/connectbot/cbssh/pull/194 | x_refsource_MISC |
| https://github.com/connectbot/cbssh/commit/a08421… | x_refsource_MISC |
| https://github.com/connectbot/cbssh/releases/tag/v0.3.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| connectbot | cbssh |
Affected:
< 0.3.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54700",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T22:05:55.418262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T22:06:09.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cbssh",
"vendor": "connectbot",
"versions": [
{
"status": "affected",
"version": "\u003c 0.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:53:47.361Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg"
},
{
"name": "https://github.com/connectbot/cbssh/pull/194",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/pull/194"
},
{
"name": "https://github.com/connectbot/cbssh/commit/a08421fbe7cf8b72fa60fb8b2f98fb465dc43fd9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/commit/a08421fbe7cf8b72fa60fb8b2f98fb465dc43fd9"
},
{
"name": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1"
}
],
"source": {
"advisory": "GHSA-ch3q-cw5r-f4hg",
"discovery": "UNKNOWN"
},
"title": "ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54700",
"datePublished": "2026-10-13T15:53:47.361Z",
"dateReserved": "2026-06-15T22:58:06.562Z",
"dateUpdated": "2026-10-16T22:06:09.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}