CVE-2026-54700: 
Java vulnerability analysis and mitigation

CVE-2026-54700 is a memory exhaustion vulnerability in the ConnectBot SSH Client Library (org.connectbot.sshlib:sshlib) caused by unbounded SSH field lengths that can trigger excessive memory allocation. The SSH protocol parser trusted attacker-controlled length and count fields without validating them against the containing packet size, allowing a malicious or compromised SSH server to cause an OutOfMemoryError in the connecting client application. All versions up to and including 0.3.0 are affected; version 0.3.1 contains the fix. The vulnerability was published on June 11, 2026, and carries a CVSS v4 base score of 6.9 (Moderate) (GitHub Advisory).

The root cause is improper input validation (CWE-20) combined with memory allocation based on an untrusted, excessively large size value (CWE-789). The library's Kaitai Struct-generated Java parsers read unsigned 32-bit length prefixes from SSH packets and passed them directly to array allocation calls without first checking that the declared length fits within the remaining bytes of the containing stream. Because the Kaitai runtime allocates the destination byte array before attempting to read from the bounded input stream, an attacker only needs to send a small, malformed packet with an oversized inner length field — not an equally large payload — to trigger the allocation. Malformed count fields present a second vector, causing parsers to attempt an unreasonable number of repeated element iterations. Applications with SSH agent forwarding enabled face an additional attack path via malformed agent protocol messages carrying the same class of oversized length fields (GitHub Advisory).

Successful exploitation results in excessive heap allocation and potential OutOfMemoryError, causing loss of availability of the application process that embeds the library. In memory-constrained environments, a single small malicious packet is sufficient to crash the application. No confidentiality or integrity impact has been demonstrated; the vulnerability is purely an availability (denial-of-service) issue (GitHub Advisory).

No public exploit code, exploit kits, or in-the-wild exploitation have been reported for CVE-2026-54700. The vulnerability requires user interaction in the sense that a user or application must initiate an SSH connection to an attacker-controlled or compromised server; no authentication is required on the attacker's side. The EPSS score and CISA KEV catalog status are not yet available for this recently disclosed vulnerability (GitHub Advisory).

1. Set up a malicious SSH server: The attacker operates or compromises an SSH server reachable by targets using applications built on org.connectbot.sshlib:sshlib version 0.3.0 or earlier.
2. Lure the victim to connect: The attacker directs a user or automated process to initiate an SSH connection to the malicious server (e.g., via a phishing link, DNS hijacking, or supply-chain compromise of a known host).
3. Send a malformed SSH packet: Immediately after the TCP/SSH handshake begins, the server responds with a crafted SSH packet containing an inner length field (uint32) set to a value near the Java array size limit (e.g., 0x7FFFFFFF), while the actual packet payload is much smaller.
4. Trigger excessive memory allocation: The Kaitai Struct Java runtime in the client library reads the oversized length value and attempts to allocate a byte array of that declared size before discovering the input is truncated, causing an OutOfMemoryError.
5. Crash the application: The uncaught OutOfMemoryError terminates the application process embedding the library, achieving denial of service. For agent-forwarding-enabled applications, the attacker can alternatively send malformed SSH agent protocol messages after the connection is established to trigger the same class of allocation failure (GitHub Advisory).

• Logs: Java application logs showing java.lang.OutOfMemoryError or uncaught runtime exceptions originating from Kaitai Struct parsing code within the org.connectbot.sshlib package during or immediately after SSH connection establishment.
• Network: SSH connections initiated to unexpected or newly observed server IP addresses/hostnames, particularly those that terminate abnormally or very quickly after the handshake.
• Process: Sudden JVM process termination or crash dumps associated with applications using the sshlib library, especially correlated with outbound SSH connection attempts.
• Application Behavior: Repeated application crashes or restarts that coincide with SSH connection attempts to a specific remote host (GitHub Advisory).

Upgrade org.connectbot.sshlib:sshlib to version 0.3.1 or later, which validates length-prefixed fields against the remaining bytes in their containing Kaitai stream, validates repeated-element counts against the minimum encoded size of each element, and converts malformed SSH packet parsing failures into TransportException rather than allowing unchecked exceptions to propagate. No configuration-based workaround is available for the general SSH packet path; disabling SSH agent forwarding eliminates the additional agent protocol attack vector but does not address the primary vulnerability. Organizations should audit all Maven dependencies for use of affected versions and prioritize upgrading (GitHub Advisory, cbssh v0.3.1 Release).