ConnectBot cbssh CVE-2026-54700

The victim must actively initiate an SSH connection from an application using cbssh/sshlib <= 0.3.0 to an attacker-controlled or compromised SSH server; this user/application-initiated outbound connection is the core prerequisite (UI:A) and is the main limiting factor, since the attacker cannot push the malformed packet to passive victims. For the general transport path, no authentication and no optional feature are required - the malicious server only needs to return one malformed packet with an oversized inner length or element count. A second, narrower path through malformed SSH-agent protocol messages additionally requires that SSH agent forwarding be explicitly enabled by the client. Exploitation is limited to clients that connect to untrusted endpoints and results only in a crash of the client process.

This is a denial-of-service vulnerability (CWE-20, improper input validation) in the ConnectBot cbssh/sshlib SSH client library whose real-world priority is moderate, not critical. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H) correctly characterizes it: network-reachable, low complexity, no authentication, but it REQUIRES user interaction (UI:A) because the victim's client must first initiate a connection to an attacker-controlled or compromised SSH server - the server cannot reach out to victims. Impact is availability-only (VA:H); the advisory and description explicitly state there is NO confidentiality or integrity impact, so the score of 6.9 is driven entirely by process-crash DoS. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was identified, so all three exploitation-likelihood signals are either absent or negative and point to low active-exploitation pressure. The most important caveat: this is a client-side flaw triggered by a MALICIOUS SERVER, which inverts the usual threat model - it only matters for clients that connect to untrusted or potentially-compromised SSH endpoints, and the impact is limited to crashing the client application process. Note the input tag 'Information Disclosure' conflicts with the actual availability-only impact and appears to be mislabeled.

A user running an application built on the vulnerable ConnectBot sshlib (<= 0.3.0) connects to an attacker-controlled or compromised SSH server. The server replies with a small, deliberately malformed packet whose inner length or element-count field declares a size far larger than the packet itself; the Kaitai Struct Java runtime pre-allocates a byte array for that declared size before detecting the truncated input, raising an uncaught OutOfMemoryError that terminates the client process. No public proof-of-concept exploit was identified, and exploitation requires the victim to initiate the connection (UI:A).