EUVD-2026-98839
GHSA-vc8p-8pxg-rfwg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed DER private-key file
-
DeliveryVictim loads key via SSH client API
-
ExploitreadLength() accepts oversized long-form octets
-
ExecutionInteger wraparound bypasses allocation check
-
ImpactUncaught OutOfMemoryError terminates application process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user or application to explicitly load an attacker-provided private-key file through one of SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() on a vulnerable version (<= 0.3.0 of org.connectbot.sshlib:sshlib / cbssh). The flaw is NOT reachable from SSH server host keys or agent-forwarding messages, so a malicious SSH server cannot trigger it and it is not remotely exploitable. Limiting factors: local vector plus required user interaction (the victim must actively supply/open the malicious key), and the impact is confined to a process crash - no code execution or data exposure. |
| Impact | This is a medium-severity availability-only defect that does not warrant emergency prioritization. The vendor CVSS is a 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A, 6.7) - note it is NOT a 3.1 vector, so direct comparison with 3.1-based tooling requires re-mapping. The vector is Local (AV:L) and requires active user interaction (UI:A): the victim must explicitly load an attacker-supplied private-key file. The only demonstrated impact is availability (VA:H) via an uncaught OutOfMemoryError that can terminate the application process; the advisory explicitly states no confidentiality or integrity impact and no usable weakened key was demonstrated, which directly contradicts the 'Information Disclosure' tag in the input metadata. No EPSS score, CISA KEV listing, or public exploit was provided in the intelligence set, so exploitation status is 'no public exploit identified at time of analysis.' Because the vulnerable DER path is not reachable from SSH server host keys or agent-forwarding, there is no remote network exposure. Net: a genuine but narrowly-scoped DoS requiring social engineering (tricking a user/app into loading a malicious key), not a high-urgency widespread threat. Minor data conflict to verify: the package evidence lists 'fixed in: None' while the description and release tag confirm the fix is in 0.3.1. |
| Exploit ScenarioDerived | An attacker crafts a malformed DER private-key file whose long-form length octets encode an oversized or wrapped length value. A user or application is tricked into loading that key through an API such as SshKeys.decodePemPrivateKey() or SshClient.authenticatePublicKey(), causing the parser to allocate a huge array (e.g., a 6-byte value declaring a 1 GiB INTEGER) and throw an uncaught OutOfMemoryError that crashes the process. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Loading an attacker-supplied DER private-key file into the ConnectBot cbssh SSH client library (sshlib) 0.3.0 and earlier can crash the hosting application process: the DER parser accepts oversized long-form length octets, accumulates them into a 32-bit Int where they wrap around, and then allocates arrays sized by the resulting value without checking it against the remaining input. The reachable entry points are SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), and SshSigning.getPublicKey(); the flaw is not reachable from SSH server host keys or agent-forwarding messages, so a malicious SSH server cannot trigger it. Exploitation is local and requires the victim to deliberately open or supply the malicious key file, and the demonstrated impact is availability only - an uncaught OutOfMemoryError that terminates the process - with no code execution, no confidentiality impact, and no usable weakened key demonstrated; no public exploit code or confirmed in-the-wild exploitation is identified at time of analysis, and vendor-released patch version 0.3.1 resolves it.
RemediationAI
Vendor-released patch: upgrade org.connectbot.sshlib:sshlib (ConnectBot cbssh) to version 0.3.1, available from the release tag at https://github.com/connectbot/cbssh/releases/tag/v0.3.1, which incorporates commit 2bb917517bec0df229a02ca768d6eae84be72df0; see the advisory at https://github.com/connectbot/cbssh/security/advisories/GHSA-vc8p-8pxg-rfwg for the full description. If the upgrade cannot be applied immediately, the effective compensating control is to stop feeding untrusted DER/PEM private-key files into the four affected APIs - restrict key import to keys generated locally or fetched from a trusted provisioning channel, and reject user-supplied key files at the application layer with strict size and format allow-listing (trade-off: users who legitimately import third-party keys lose that workflow until patched). Running the parsing path in a separate, memory-capped process or worker isolates the fallout of an OutOfMemoryError to that process rather than the whole application, at the cost of added architectural complexity. Do not rely on catching the error: OutOfMemoryError is an Error, not an Exception, so it bypasses normal public-key authentication error handling, and a catch(Throwable) wrapper around parsing is unreliable once the JVM heap is exhausted. Note that SSH server host-key parsing and agent-forwarding paths are unaffected, so no network-facing or server-side hardening is required for this specific defect; the only meaningful fixes are upgrading to 0.3.1 or restricting which private-key files are parsed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cbssh/sshlib is a Kotlin SSH client library that uses Kaitai Struct and KStateMachine, and it parses application-supplied private keys through a hand-written DER (Distinguished Encoding Rules) reader in sshlib/src/main/kotlin/org/connectbot/sshlib/crypto/Der.kt. DER is a TLV (tag-length-value) encoding in which a length can be short form (single octet, 0-127) or long form (a leading octet with the high bit set whose low seven bits give the number of subsequent length octets). The vulnerable readLength() accepted up to 127 long-form length octets and folded each one into an Int with 'length = (length shl 8) or nextByte', which is CWE-190 Integer Overflow or Wraparound: values such as 0x1_0000_0001 wrapped to 1 and 0x8000_0000 wrapped to Int.MIN_VALUE. Primitive readers such as readInteger() then executed 'val bytes = ByteArray(length); data.get(bytes)' without validating the declared length against data.remaining(), so a six-byte DER value declaring a 1 GiB INTEGER immediately produced OutOfMemoryError under a constrained JVM heap. Because OutOfMemoryError derives from Error rather than Exception, it escapes the public-key authentication error handling and can terminate the process. A zero-length DER INTEGER is separately invalid: Java throws NumberFormatException when building a BigInteger from an empty byte array, so it does not silently yield BigInteger.ZERO. The upstream fix replaces the ad-hoc checks with readExpectedTag(), requireAvailable(), and readBytes() helpers, rejects indefinite lengths (octets == 0), caps long-form lengths at Int.SIZE_BYTES (four octets), rejects redundant leading zero length octets, rejects non-minimally encoded lengths, refuses lengths above Int.MAX_VALUE, verifies declared lengths against the remaining buffer before allocation, and adds INTEGER leading-zero/0xFF canonical checks plus an empty-string guard. The CPE cpe:2.3:a:connectbot:cbssh:*:*:*:*:*:*:*:* identifies the affected package, and the Maven coordinate given in the advisory is org.connectbot.sshlib:sshlib, vulnerable through 0.3.0.
Know when Cbssh gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local key-file parsing requiring the user to load attacker-supplied input (AV:L, UI:R), no auth needed (PR:N), only a process-crash DoS so A:H with C:N/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB