CVE-2026-54700: CWE-20: Improper Input Validation in connectbot cbssh

ConnectBot SSH Client Library versions prior to 0.3.1 contain a vulnerability in the SSH protocol parser where it trusts attacker-controlled inner byte lengths and element counts without verifying their bounds within the containing packet. A malicious or compromised SSH server can exploit this by sending a malformed packet with oversized declarations, causing the Kaitai Struct Java runtime to perform excessive memory allocation or repeated parsing attempts before detecting truncated input. This results in an uncaught OutOfMemoryError that terminates the application process. The vulnerability affects the general transport path requiring a client connection but no authentication, and also affects malformed SSH-agent messages when SSH agent forwarding is used. The vulnerability does not impact confidentiality or integrity. The issue is resolved in version 0.3.1.

The vulnerability can cause the ConnectBot SSH client application to crash due to an uncaught OutOfMemoryError triggered by malformed packets from a malicious or compromised SSH server. There is no evidence of confidentiality or integrity compromise. The impact is denial of service through application termination.

Upgrade ConnectBot SSH Client Library to version 0.3.1 or later, where this vulnerability is fixed. No other mitigation is required as the issue is resolved in the official fix.