CVE-2026-54697: 
Java vulnerability analysis and mitigation

CVE-2026-54697 is an integer overflow and excessive memory allocation vulnerability in the ConnectBot SSH Client Library (org.connectbot.sshlib:sshlib) affecting all versions up to and including 0.3.0. The flaw resides in the DER private-key parser, which fails to safely validate encoded length values before converting them to Int values or allocating arrays, enabling a malformed private-key file to trigger an uncaught OutOfMemoryError and potentially terminate the application process. It was published on June 11, 2026, and patched in version 0.3.1. The vulnerability carries a CVSS v4 base score of 6.7 (Moderate) (GitHub Advisory, GHSA).

The root cause is classified under CWE-190 (Integer Overflow or Wraparound) and CWE-789 (Memory Allocation with Excessive Size Value). The vulnerable code in DerReader.readLength() accumulated up to 127 length octets into a Kotlin Int using bitwise shifts (length = (length shl 8) or nextByte), allowing values such as 0x1_0000_0001 to wrap to 1 or 0x8000_0000 to wrap to Int.MIN_VALUE. Primitive readers like readInteger() then allocated byte arrays directly from the (potentially overflowed) length value without first checking it against the remaining input (val bytes = ByteArray(length); data.get(bytes)). Exploitation requires a user or application to load an attacker-supplied private-key file through APIs such as SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey(); the vulnerability is not reachable via SSH server host keys or agent-forwarding (GitHub Advisory).

Successful exploitation results in an availability impact only — there is no demonstrated confidentiality or integrity impact. A malformed private-key file can cause incorrect DER length interpretation due to integer wraparound, trigger excessive memory allocation, and produce an uncaught OutOfMemoryError that is not caught by the public-key authentication error handler, potentially terminating the entire application process. For example, a six-byte DER value declaring a 1 GiB INTEGER caused an immediate OutOfMemoryError in testing with a constrained JVM heap (GitHub Advisory).

1. Craft malformed private-key file: Create a DER-encoded private-key file (e.g., PKCS#1 RSA or SEC1 EC format) with a crafted long-form length field that either overflows a 32-bit integer (e.g., encoding 0x8000_0000 to wrap to Int.MIN_VALUE) or declares an extremely large allocation (e.g., a 1 GiB INTEGER in six bytes).
2. Social engineering / supply chain: Deliver the malformed key file to a target user or application, for example by substituting a legitimate private key in a shared configuration, a compromised key repository, or via a social engineering lure.
3. Trigger parsing: Induce the target application (using sshlib ≤ 0.3.0) to load the malformed key through one of the vulnerable APIs: SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey().
4. Achieve denial of service: The DER parser attempts to allocate a ByteArray of the overflowed or excessively large length, triggering an OutOfMemoryError that is not caught by the authentication error handler, terminating the application process (GitHub Advisory).

• Logs: JVM crash logs or application logs showing java.lang.OutOfMemoryError originating from DerReader.readLength(), DerReader.readInteger(), or related DER parsing stack frames within the org.connectbot.sshlib package.
• File System: Presence of unexpected or externally sourced private-key files (PEM/DER format) in application key directories that were not generated by the local user; files with anomalously small sizes but claiming large internal lengths.
• Process: Unexpected application process termination or crash dumps coinciding with SSH public-key authentication attempts; JVM heap dump files generated at the time of authentication (GitHub Advisory).

The fix is available in org.connectbot.sshlib:sshlib version 0.3.1, released June 11, 2026. The patched DER parser rejects indefinite lengths, limits long-form lengths to four octets and values above Int.MAX_VALUE, accumulates lengths in a Long before converting to Int, validates declared lengths against remaining input before allocation, and rejects zero-length and non-canonical encodings. No configuration-based workaround is available; upgrading to version 0.3.1 is the only remediation. Applications should also ensure private-key files are sourced only from trusted locations to reduce the attack surface (GitHub Advisory, Release v0.3.1).