org.connectbot.sshlib vulnerabilities

Products

• org.connectbot.sshlib/sshlib 2

Latest org.connectbot.sshlib CVEs

Newest publication first

1. CVE-2026-54697 ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing

   Published 2026-10-13

   Medium·CVSS 6.7

   ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size ag...

2. CVE-2026-54700 ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation

   Published 2026-10-13

   Medium·CVSS 6.9

   ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised S...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.