{"cve":"CVE-2026-54697","nvd":{"published":"2026-10-13T16:17:21.297","modified":"2026-10-16T20:04:29.760","status":"Deferred","description":"ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6.7},"cvss_v3":null,"cwes":["CWE-190","CWE-789"],"references":["https://github.com/connectbot/cbssh/commit/2bb917517bec0df229a02ca768d6eae84be72df0","https://github.com/connectbot/cbssh/releases/tag/v0.3.1","https://github.com/connectbot/cbssh/security/advisories/GHSA-vc8p-8pxg-rfwg"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:58:52.678897993+00:00"},"epss":{"cve":"CVE-2026-54697","score":0.00125,"percentile":0.02185,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-vc8p-8pxg-rfwg","url":"https://osv.dev/vulnerability/GHSA-vc8p-8pxg-rfwg","summary":"ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing","modified":"2026-07-08T17:56:37.718101Z","packages":[{"ecosystem":"Maven","name":"org.connectbot.sshlib:sshlib","purl":"pkg:maven/org.connectbot.sshlib/sshlib","ranges":["<=0.3.0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}