Vulnerability-Lookup

CVE-2026-54700 (GCVE-0-2026-54700)

Vulnerability from cvelistv5 – Published: 2026-10-13 15:53 – Updated: 2026-10-16 22:06

Title

ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation

Summary

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 22:05 UTC

CWE

CWE-20 - Improper Input Validation
CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/connectbot/cbssh/security/advi…	x_refsource_CONFIRM
https://github.com/connectbot/cbssh/pull/194	x_refsource_MISC
https://github.com/connectbot/cbssh/commit/a08421…	x_refsource_MISC
https://github.com/connectbot/cbssh/releases/tag/v0.3.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
connectbot	cbssh	Affected: < 0.3.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54700",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T22:05:55.418262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T22:06:09.220Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cbssh",
          "vendor": "connectbot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T15:53:47.361Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg"
        },
        {
          "name": "https://github.com/connectbot/cbssh/pull/194",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/connectbot/cbssh/pull/194"
        },
        {
          "name": "https://github.com/connectbot/cbssh/commit/a08421fbe7cf8b72fa60fb8b2f98fb465dc43fd9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/connectbot/cbssh/commit/a08421fbe7cf8b72fa60fb8b2f98fb465dc43fd9"
        },
        {
          "name": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-ch3q-cw5r-f4hg",
        "discovery": "UNKNOWN"
      },
      "title": "ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54700",
    "datePublished": "2026-10-13T15:53:47.361Z",
    "dateReserved": "2026-06-15T22:58:06.562Z",
    "dateUpdated": "2026-10-16T22:06:09.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54700",
      "date": "2026-10-16",
      "epss": "0.0037",
      "percentile": "0.29322"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "cbssh",
                "vendor": "connectbot",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.3.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1."
          }
        ],
        "id": "CVE-2026-54700",
        "lastModified": "2026-10-16T23:17:02.113",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54700",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T22:05:55.418262Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-13T16:17:21.560",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/connectbot/cbssh/commit/a08421fbe7cf8b72fa60fb8b2f98fb465dc43fd9"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/connectbot/cbssh/pull/194"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-789"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-54700

Vulnerability from fkie_nvd - Published: 2026-10-13 16:17 - Updated: 2026-10-16 23:17

Severity

6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/connectbot/cbssh/commit/a08421fbe7cf8b72fa60fb8b2f98fb465dc43fd9
	security-advisories@github.com	https://github.com/connectbot/cbssh/pull/194
	security-advisories@github.com	https://github.com/connectbot/cbssh/releases/tag/v0.3.1
	security-advisories@github.com	https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cbssh",
          "vendor": "connectbot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1."
    }
  ],
  "id": "CVE-2026-54700",
  "lastModified": "2026-10-16T23:17:02.113",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54700",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-16T22:05:55.418262Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-13T16:17:21.560",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/connectbot/cbssh/commit/a08421fbe7cf8b72fa60fb8b2f98fb465dc43fd9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/connectbot/cbssh/pull/194"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CH3Q-CW5R-F4HG

Vulnerability from github – Published: 2026-06-12 21:02 – Updated: 2026-07-08 17:35

Summary

ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation

Details

Summary

The SSH protocol parser trusted attacker-controlled length and count fields without first checking that the declared values fit within the containing packet.

When a client connects to a malicious or compromised SSH server, the server can send a small, malformed packet containing an inner field whose declared length is much larger than the packet itself. The Kaitai Struct Java runtime attempts to allocate a byte array using the declared length before it discovers that the input is truncated. A sufficiently large value can therefore cause excessive memory allocation or an uncaught OutOfMemoryError, potentially terminating the application process that uses the library.

Applications that enable SSH agent forwarding have an additional attack path: the connected server can send malformed agent protocol messages containing the same class of oversized inner length.

Details

SSH uses unsigned 32-bit length prefixes for strings and other protocol structures. Before the fix, several Kaitai Struct definitions passed these lengths directly to generated parsing code. For example, the byte-string definition read a uint32 followed by an array of that size without validating the size against the bytes remaining in the current stream.

The SSH transport limits the size of an outer packet, but an inner field in that packet could still declare a length approaching the Java array size limit. The Kaitai runtime allocates the destination array before reading from the bounded input stream. Consequently, an attacker does not need to transmit an equally large packet to trigger the allocation attempt.

Malformed count fields could also cause parsers to attempt an unreasonable number of repeated elements. The fix validates both byte lengths and element counts against the size of their containing stream.

Parsing failures previously surfaced inconsistently as unchecked runtime exceptions. The fixed version converts malformed SSH packets to a transport protocol error and returns an SSH agent failure response for malformed agent requests.

Attack Requirements

For the general SSH packet path:

A user or application must initiate a connection to an attacker-controlled or compromised SSH server.
Authentication is not required.
No optional library feature is required.
The server only needs to return a malformed SSH packet containing an oversized inner length or count.

For the agent protocol path, SSH agent forwarding must additionally be enabled.

Impact

Successful exploitation can cause excessive heap allocation and loss of availability of the application process. In constrained environments, a single small malicious packet can cause an OutOfMemoryError.

No confidentiality or integrity impact has been demonstrated.

Remediation

Upgrade to version 0.3.1 or later.

The fix:

Validates length-prefixed fields against the remaining bytes in their containing Kaitai stream.
Validates repeated-element counts against the minimum encoded size of each element.
Validates SSH transport and agent frame lengths and padding constraints.
Converts malformed SSH packet parsing failures into TransportException.
Returns SSH_AGENT_FAILURE for malformed forwarded-agent requests instead of allowing parser exceptions to escape.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.connectbot.sshlib:sshlib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54700"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T21:02:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe SSH protocol parser trusted attacker-controlled length and count fields without first checking that the declared values fit within the containing packet.\n\nWhen a client connects to a malicious or compromised SSH server, the server can send a small, malformed packet containing an inner field whose declared length is much larger than the packet itself. The Kaitai Struct Java runtime attempts to allocate a byte array using the declared length before it discovers that the input is truncated. A sufficiently large value can therefore cause excessive memory allocation or an uncaught `OutOfMemoryError`, potentially terminating the application process that uses the library.\n\nApplications that enable SSH agent forwarding have an additional attack path: the connected server can send malformed agent protocol messages containing the same class of oversized inner length.\n\n## Details\n\nSSH uses unsigned 32-bit length prefixes for strings and other protocol structures. Before the fix, several Kaitai Struct definitions passed these lengths directly to generated parsing code. For example, the byte-string definition read a `uint32` followed by an array of that size without validating the size against the bytes remaining in the current stream.\n\nThe SSH transport limits the size of an outer packet, but an inner field in that packet could still declare a length approaching the Java array size limit. The Kaitai runtime allocates the destination array before reading from the bounded input stream. Consequently, an attacker does not need to transmit an equally large packet to trigger the allocation attempt.\n\nMalformed count fields could also cause parsers to attempt an unreasonable number of repeated elements. The fix validates both byte lengths and element counts against the size of their containing stream.\n\nParsing failures previously surfaced inconsistently as unchecked runtime exceptions. The fixed version converts malformed SSH packets to a transport protocol error and returns an SSH agent failure response for malformed agent requests.\n\n## Attack Requirements\n\nFor the general SSH packet path:\n\n- A user or application must initiate a connection to an attacker-controlled or compromised SSH server.\n- Authentication is not required.\n- No optional library feature is required.\n- The server only needs to return a malformed SSH packet containing an oversized inner length or count.\n\nFor the agent protocol path, SSH agent forwarding must additionally be enabled.\n\n## Impact\n\nSuccessful exploitation can cause excessive heap allocation and loss of availability of the application process. In constrained environments, a single small malicious packet can cause an `OutOfMemoryError`.\n\nNo confidentiality or integrity impact has been demonstrated.\n\n## Remediation\n\nUpgrade to version `0.3.1` or later.\n\nThe fix:\n\n- Validates length-prefixed fields against the remaining bytes in their containing Kaitai stream.\n- Validates repeated-element counts against the minimum encoded size of each element.\n- Validates SSH transport and agent frame lengths and padding constraints.\n- Converts malformed SSH packet parsing failures into `TransportException`.\n- Returns `SSH_AGENT_FAILURE` for malformed forwarded-agent requests instead of allowing parser exceptions to escape.",
  "id": "GHSA-ch3q-cw5r-f4hg",
  "modified": "2026-07-08T17:35:55Z",
  "published": "2026-06-12T21:02:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/connectbot/cbssh/security/advisories/GHSA-ch3q-cw5r-f4hg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/connectbot/cbssh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/connectbot/cbssh/releases/tag/v0.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54700 (GCVE-0-2026-54700)

FKIE_CVE-2026-54700

GHSA-CH3Q-CW5R-F4HG

Summary

Details

Attack Requirements

Impact

Remediation

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour