CVE-2026-54697

Executive Summary

CVE-2026-54697 is a denial-of-service class vulnerability in the ConnectBot SSH Client Library, written in Kotlin with Kaitai Struct and KStateMachine. Versions prior to 0.3.1 contain a DER parsing flaw in which DerReader.readLength() accepts excessively long-form length octets, accumulates them into a 32-bit Int, and then allows primitive readers to allocate arrays without validating the declared size against the remaining input length. Any application or end user that loads an attacker-supplied private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive memory allocation, or an uncaught OutOfMemoryError. No weakened key material, confidentiality, or integrity impact has been demonstrated; the confirmed effect is availability loss (process crash or resource exhaustion), and the issue is resolved in version 0.3.1.

Technical Analysis

The vulnerability resides in the DER (Distinguished Encoding Rules) parsing layer of the ConnectBot SSH Client Library. DER is a binary encoding scheme used within X.509 and, critically for this library, within PEM-encoded and binary private-key containers that SSH tooling frequently parses.

The affected logic is concentrated in DerReader.readLength(). In DER, the length field of a TLV (type-length-value) triplet may be encoded in two forms: a short form (a single octet for lengths 0–127) and a long form, in which the leading octet sets the high bit to indicate that the remaining low bits specify how many subsequent octets contain the length value. A robust parser must bound the number of long-form length octets it will accept. According to the NVD description, DerReader.readLength() does not impose such a bound on the count of long-form length octets and instead accumulates the resulting value into an Int.

This creates two distinct failure modes:

1. Integer wraparound. Because the accumulated value is stored in a 32-bit signed Int, a length field composed of excessive long-form octets can overflow the accumulator. Rather than the parser rejecting an implausibly large declared length, the value wraps, producing an incorrect or unexpectedly small/negative length relative to the attacker's intent. This breaks the parser's internal invariants about how much data is expected versus how much remains in the input buffer.

2. Unchecked allocation. The NVD description states that "primitive readers allocate arrays without checking the declared size against the remaining input." In other words, a primitive reader reads a declared element/array length from the (potentially wrapped) accumulator and immediately allocates a buffer of that size, without first confirming that the underlying input stream actually contains that many bytes. On the JVM (the runtime for Kotlin), such an allocation attempt can raise java.lang.OutOfMemoryError, which is an Error rather than an Exception and is frequently not caught by application-level try/catch blocks — resulting in an uncaught error and process termination.

The attack surface is specifically the application- or user-supplied private-key input path, reached via:

• SshClient.authenticatePublicKey()
• SshKeys.decodePemPrivateKey()
• SshSigning.sign()
• SshSigning.getPublicKey()

Critically, the NVD description explicitly scopes the risk: "SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path." This means the flaw is not triggerable by a malicious SSH server presenting a host key, nor via the SSH agent protocol. The attacker must instead cause a crafted private-key file to be loaded through the application code path above — for example, a malformed PEM private key that the user or application supplies to the library.

The classification as CWE-190 (Integer Overflow or Wraparound) aligns precisely with the accumulation-into-Int behavior. The consequence is availability-focused (denial of service via crash or resource exhaustion), not a cryptographic key-recovery or plaintext-disclosure issue; the description affirms that "no usable weakened key and no confidentiality or integrity impact have been demonstrated."

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is currently available for CVE-2026-54697. The attack chain below is inferred from the vulnerability class (CWE-190 integer wraparound leading to excessive allocation in a DER parser) and the explicit input paths named in the NVD description. No specific function names, payload byte sequences, or file structures beyond those stated are asserted.

1. Reconnaissance / target identification. The attacker identifies an application or user that loads SSH private-key material through the ConnectBot SSH Client Library at a version below 0.3.1. Because the affected code path is not network-facing, reconnaissance is opportunistic: the attacker needs a delivery vector by which a crafted private-key file reaches a victim who will import or load it. Relevant contexts include CLI tools or desktop/mobile apps that let a user open a "key file," automation that ingests externally sourced key material, or workflows where keys are exchanged between parties or fetched from untrusted storage.

2. Triggering the flaw class. The attacker crafts a DER/PEM-encoded private-key file in which the DER length field uses an excessive number of long-form length octets. When the victim application calls one of the named entry points (SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey()), DerReader.readLength() processes the over-long length encoding and accumulates the value into an Int. The accumulated value wraps or becomes implausibly large.

3. Payload / execution method (class-level). Following the wrapped/inflated length, a primitive reader attempts to allocate an array sized by the declared length without verifying that the remaining input actually contains that many bytes. Depending on the value produced, the outcome is one of three class-level effects described in the advisory: integer wraparound yielding inconsistent parsing state, an excessive allocation (memory pressure), or an uncaught OutOfMemoryError. No instruction-level payload, code-execution primitive, or remote code path is described; this is a resource-exhaustion/crash condition.

4. Post-exploitation impact. Successful triggering degrades availability of the affected application process — the most severe stated outcome being an uncaught OutOfMemoryError that terminates the JVM process or otherwise destabilizes it. There is no demonstrated path to key leakage, key weakening, authentication bypass, or data tampering; the advisory explicitly states no confidentiality or integrity impact has been shown. In shared or long-running processes, memory pressure from the allocation attempt could also affect co-resident workloads until the process is bounded or killed.

Impact Assessment

The impact of CVE-2026-54697 is confined to availability. Per the advisory, the demonstrated outcome is integer wraparound, excessive allocation, or an uncaught OutOfMemoryError; no usable weakened key and no confidentiality or integrity impact have been demonstrated. There is likewise no evidence of code execution, authentication bypass, or private-key disclosure.

• Primary affected asset: any application or end user that supplies private-key files to the library through the four named entry points. This is a client-/local-side input path rather than a remotely reachable network service.
• Blast radius: scoped to the process performing key parsing. An uncaught OutOfMemoryError can crash a JVM process outright (complete loss of that application's availability) or induce transient memory pressure. If the parsing occurs inside a shared runtime, other workloads in that runtime may be affected while the condition persists.
• Attack prerequisites: the attacker must convince a target to load a crafted key file (user interaction, UI:R) and must have some delivery path for the malformed key material. No network reachability to the parsing component is inherent.
• Explicitly out of scope: SSH server host keys and agent-forwarding messages do not use the application-supplied private-key input path and are therefore not vectors for this flaw.

CVSS subscores. No official CVSS base score or vector is published for this CVE (CVSS = N/A in the source data); therefore no numeric breakdown is asserted here. The vector line in METADATA (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) is an analyst-constructed characterization consistent with the described facts — a locally delivered, user-interaction-dependent, availability-only impact — and is provided for detection/triage orientation only, not as a vendor-published score.

CISA KEV: Not listed. EPSS: Not yet scored by FIRST.org. Public exploit: None observed.

Detection Guidance

Detection focuses on the artifact and behavior of malformed key import and on abnormal memory-exhaustion signatures, since there is no network protocol signature for this client-side parser flaw. The rules below are oriented to the vulnerability class and the named code paths.

Sigma Rule

title: Potential ConnectBot SSH DER Length Parsing DoS via Malformed Private Key
id: 3f2b9c14-8a1e-4d6e-9c2a-54697cve0001
status: experimental
description: Detects process memory exhaustion / OutOfMemoryError conditions associated with loading an attacker-supplied SSH private key through the ConnectBot SSH Client Library (CVE-2026-54697), affected versions < 0.3.1.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54697
author: valtersit threat intelligence
date: 2026/01/01
logsource:
  category: application
  product: java
detection:
  keywords_oom:
    - 'java.lang.OutOfMemoryError'
    - 'Requested array size exceeds VM limit'
  keywords_ctx:
    - 'DerReader.readLength'
    - 'decodePemPrivateKey'
    - 'authenticatePublicKey'
    - 'SshSigning'
  condition: keywords_oom and keywords_ctx
fields:
  - process
  - command_line
  - user
falsepositives:
  - Legitimate large key files
  - Genuine out-of-memory conditions from unrelated workloads
level: medium
tags:
  - attack.t1204.002
  - cwe.190

YARA Rule

rule CVE_2026_54697_ConnectBot_DER_OversizedLength
{
    meta:
        description = "Detects PEM/DER material carrying excessive long-form DER length octets characteristic of CVE-2026-54697 attack input"
        author = "valtersit threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54697"
        date = "2026-01-01"
        cwe = "CWE-190"

    strings:
        $pem_begin = "-----BEGIN" ascii
        $pem_rsa   = "PRIVATE KEY" ascii
        $pem_ec    = "EC PRIVATE KEY" ascii
        $der_seqs = { 30 84 00 00 }        // SEQUENCE with long-form 4-byte length prefix (candidate)

    condition:
        filesize < 1MB and
        uint16(0) == 0x2D2D and             // file begins with "--"
        $pem_begin and
        any of ($pem_rsa, $pem_ec)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-54697 ConnectBot SSH DER oversize length octet pattern in transferred key material"; flow:established,to_server,to_client; content:"|30 84|"; depth:1; pcre:"/\x30\x84.{4,}/s"; classtype:attempted-dos; reference:cve,2026-54697; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-54697; sid:5469701; rev:1;)

Note: no dedicated network protocol signature exists for this client-side parser flaw; this rule only opportunistically flags transferred DER blobs containing long-form SEQUENCE length headers and should be tuned to reduce false positives on legitimate certificates.

Elastic Detection

process where event.type == "start" or event.category == "process"
  and process.command_line != null
  and (
    process.command_line : "*decodePemPrivateKey*" or
    process.command_line : "*authenticatePublicKey*" or
    process.command_line : "*SshSigning*"
  )
  and process.command_line : "*.pem*"

Supplement with a log-based EQL for OOM events:

sequence by host.id
  [ any where message : "*OutOfMemoryError*" ]
  [ any where message : ("*DerReader*" or "*decodePemPrivateKey*" or "*SshSigning*") ]

Splunk SPL Query

index=app_logs (message="*OutOfMemoryError*" OR message="*Requested array size exceeds VM limit*")
| append [ search index=app_logs (message="*DerReader.readLength*" OR message="*decodePemPrivateKey*" OR message="*authenticatePublicKey*" OR message="*SshSigning.getPublicKey*" OR message="*SshSigning.sign*") ]
| stats count min(_time) as first_seen max(_time) as last_seen by host, source, user, message
| where count > 0

Wazuh OSSEC Rule

<group name="connectbot_cve_54697,">
  <rule id="546971" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">.*(DerReader\.readLength|decodePemPrivateKey|authenticatePublicKey|SshSigning).*</field>
    <description>CVE-2026-54697: ConnectBot SSH library parsed an untrusted private key on an affected code path</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>cwe_190,</group>
  </rule>

  <rule id="546972" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">.*(java\.lang\.OutOfMemoryError|Requested array size exceeds VM limit).*</field>
    <description>CVE-2026-54697: Possible SSH key-parse DoS - OutOfMemoryError during DER/private-key processing</description>
    <group>cwe_190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor-fix reference, workaround, or OSV package mapping was supplied in the source data beyond the advisory statement that the issue is fixed in version 0.3.1.

1. Immediate mitigations.

   • Treat untrusted or externally supplied SSH private-key files as hazardous input. Do not import key files of unknown provenance into applications built on the ConnectBot SSH Client Library below 0.3.1.
   • Pre-filter key material before handing it to the library: reject PEM/DER inputs whose DER length fields use excessive long-form length octets, or cap the maximum accepted DER object size, preferring files that fail closed.
   • Where feasible, wrap the affected call sites (SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), SshSigning.getPublicKey()) and catch Throwable rather than only Exception, so that an OutOfMemoryError does not terminate the process uncaught.
   • Impose JVM/runtime memory limits and per-request allocation ceilings so a single malformed key cannot exhaust process memory.

2. Patch / upgrade steps.

   • Upgrade the ConnectBot SSH Client Library to version 0.3.1 or later, which the advisory states fixes the issue.
   • Rebuild and redeploy any dependent application against the fixed library version, and verify the resolved dependency version in the build manifest.
   • Because the tracked patch confidence is 0/4 and no patch source is recorded, independently confirm the fixed release from the upstream project before closing the finding.

3. Long-term hardening.

   • Adopt strict bounds-checking practices in all binary parsers: validate declared lengths against remaining input before allocation, and constrain long-form length octet counts.
   • Use overflow-safe integer handling (e.g., detecting/guarding against wraparound on 32-bit accumulators) in parsing code that consumes attacker-controlled lengths.
   • Add fuzz testing of key-parsing entry points with malformed DER length encodings to catch this class of defect pre-release.
   • Track the upstream library for security advisories and pin to a known-good minimum version in dependency policy.

References

• NVD — CVE-2026-54697: https://nvd.nist.gov/vuln/detail/CVE-2026-54697
• CWE-190 — Integer Overflow or Wraparound: https://cwe.mitre.org/data/definitions/190.html
• ConnectBot SSH Client Library project (upstream advisories/releases): https://github.com/connectbot
• MITRE ATT&CK T1204.002 — User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-54697 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaign, public exploit, or in-the-wild exploitation evidence is associated with CVE-2026-54697 in the available data. EPSS has not yet scored this CVE, and it is not listed in CISA KEV.