Vulnerability in SSH Client Library Affects ConnectBot Application

CVE-2026-54700

What is CVE-2026-54700?

The ConnectBot SSH Client Library, written in Kotlin, is vulnerable to a denial-of-service issue due to mishandling of attacker-controlled inner byte lengths and element counts in the SSH protocol parser. This flaw allows a malicious SSH server to send a specially crafted malformed packet, potentially causing excessive memory allocation or repeated parsing attempts, which can eventually trigger an uncaught OutOfMemoryError, resulting in application termination. No authentication is required to exploit this flaw, and it affects clients with SSH agent forwarding enabled. The issue has been resolved in version 0.3.1.

References