CVE-2026-54700

Executive Summary

CVE-2026-54700 is an input validation vulnerability in the ConnectBot SSH Client Library (a Kotlin library using Kaitai Struct and KStateMachine), affecting versions prior to 0.3.1. A malicious or compromised SSH server can send a small malformed packet with attacker-controlled inner byte lengths or element counts that are not validated against the containing packet size, causing the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The impact is a denial-of-service condition (uncaught OutOfMemoryError terminating the application process), with no demonstrated confidentiality or integrity impact; exploitation requires a client connection and, for SSH-agent message attacks, SSH agent forwarding.

Technical Analysis

The ConnectBot SSH Client Library is responsible for parsing SSH protocol messages. It is implemented in Kotlin, with binary parsing generated by Kaitai Struct and state handling managed by KStateMachine. The core flaw is a classic unchecked-length/declared-size validation error (CWE-20, Improper Input Validation): the parser trusts inner byte lengths and element counts supplied by the remote peer without verifying that those declared sizes actually fit within the bounds of the enclosing packet.

In the SSH protocol, packets carry length-prefixed structures. A parser that reads a declared length and immediately allocates or iterates based on that value — before confirming the declared size is consistent with the remaining bytes of the packet — can be induced into one of two failure modes described by NVD: (1) excessive allocation, or (2) repeated parsing, before the truncation is finally detected. Because the declared length is attacker-controlled and the containing packet is intentionally kept small, the mismatch drives resource consumption far beyond what the packet's actual size warrants.

The vulnerable attack surface is the general transport path, which requires only a client connection — no authentication and no optional feature is needed. A secondary surface involves malformed SSH-agent messages, which additionally require SSH agent forwarding to be enabled in the client. In both cases the trigger is a malicious or compromised SSH server responding to the client.

The observable outcome is an uncaught OutOfMemoryError that is not handled by the application, resulting in termination of the application process. NVD explicitly states there is no demonstrated confidentiality or integrity impact — this is an availability-only (denial-of-service) condition. The issue is fixed in version 0.3.1.

No public proof-of-concept or exploit code is available, and no CVSS score has been assigned by the CNA/NVD as of this report. The CVSS vector shown in METADATA is a reasoned estimate consistent with the described availability-only, network-reachable, no-privileges-required, no-user-interaction profile; it is not an official NVD score.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (improper validation of attacker-controlled lengths/counts leading to resource exhaustion) as described in the NVD entry. No specific function names, class names, or packet field names are invented here because none are provided in the source data.

1. Reconnaissance / target identification. The attacker must control (or compromise) an SSH server that a ConnectBot-based client will connect to. This is an attacker-controlled server scenario rather than a scan-and-exploit-remotely scenario: the adversary either operates a malicious endpoint or has taken over a legitimate one. Targets are client applications embedding the affected library (prior to 0.3.1).

2. Triggering the specific flaw class. Upon the client connecting, the malicious server responds with a small, malformed SSH packet whose inner declared byte lengths or element counts exceed the actual packet size. Because the parser trusts these declared values without checking them against the containing packet bounds, the Kaitai Struct Java runtime is driven into excessive allocation or repeated parsing.

3. Payload / execution method at the vulnerability-class level. The "payload" is the malformed protocol message itself — a small packet advertising oversized inner structures. No authentication is required on the general transport path. For the SSH-agent variant, the attacker must additionally be able to reach the client through agent forwarding, and the malformed data is delivered as SSH-agent messages.

4. Post-exploitation impact. The client consumes disproportionate memory or cycles parsing the inconsistent input before the truncation is detected, ultimately raising an uncaught OutOfMemoryError that terminates the application process. There is no demonstrated data theft or data modification; impact is limited to denial of service against the client application.

Impact Assessment

The impact is availability-only. An attacker who controls or compromises an SSH server can terminate a ConnectBot-based client process by supplying a small malformed packet, achieving denial of service without authentication (general transport path) or with agent forwarding enabled (agent-message path).

Blast radius depends on where the library is embedded: a desktop/mobile SSH client will lose the user's session (and potentially unsaved state) on termination, while a headless or automated client (e.g., an integration or agent) could suffer repeated crashes as it reconnects, degrading or halting dependent automation.

Because no official CVSS score is published, the following subscore reasoning is provided as an estimate aligned with the NVD description: Attack Vector Network (the peer is remote), Attack Complexity Low, Privileges Required None (no auth needed on the transport path), User Interaction None, Scope Unchanged, Confidentiality None, Integrity None, Availability High (process termination). The most material caveat is the requirement that the attacker operate or control the peer SSH server, which constrains opportunism and is why this is not a mass-scanning vector.

CISA KEV: not listed. EPSS: not yet scored.

Detection Guidance

Note: Because this flaw is triggered by malformed protocol messages between a client and its SSH server, network detection is most reliable when traffic to/from SSH endpoints is inspected at the session level or when client-side allocation failures are logged. The rules below target the observable class-level signals (abnormal SSH packet framing on port 22 and client OutOfMemoryError events) rather than invented field names.

Sigma Rule

title: ConnectBot SSH Client OutOfMemoryError Process Termination
id: 4b2f9c1e-7a51-4c3d-9e2a-0000cve2026547
status: experimental
description: Detects client process termination due to uncaught OutOfMemoryError consistent with CVE-2026-54700 malformed SSH packet handling
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54700
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: java
detection:
  selection_oom:
    EventID: 1
    Image|endswith: 'java.exe'
    CommandLine|contains:
      - 'ConnectBot'
      - 'connectbot'
  selection_error:
    - Message|contains: 'java.lang.OutOfMemoryError'
    - Message|contains: 'uncaught exception'
  condition: selection_oom and selection_error
falsepositives:
  - Legitimate memory pressure on constrained JVM hosts
  - Other applications emitting OutOfMemoryError unrelated to SSH parsing
level: medium
tags:
  - attack.t1190
  - cve.2026.54700

YARA Rule

rule CVE_2026_54700_ConnectBot_SSH_Client
{
    meta:
        description = "Detects ConnectBot SSH client library components associated with CVE-2026-54700"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54700"
        date = "2026-01-01"
        cve = "CVE-2026-54700"
    strings:
        $kaitai = "Kaitai Struct" ascii nocase
        $ksm    = "KStateMachine" ascii nocase
        $cb     = "ConnectBot" ascii nocase
        $kotlin = "kotlin" ascii nocase
    condition:
        uint16(0) == 0xCAFE or
        (filesize < 20MB and 2 of ($kaitai, $ksm, $cb, $kotlin))
}

Suricata IDS Rule

alert tcp $SSH_SERVERS any -> $HOME_NET any (msg:"CVE-2026-54700 Possible ConnectBot SSH Client DoS via Malformed Packet"; flow:established,from_server; content:"SSH-"; depth:4; byte_test:4,>,200000,0,relative; classtype:attempted-dos; sid:90054700; rev:1; reference:cve,2026-54700; metadata:affected_product ConnectBot_SSH_Client, attack_target Client_Endpoint, created_at 2026_01_01, cve CVE_2026_54700, signature_severity Major, tag SSH;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [process where process.name : "java*" and process.command_line : "*onnectBot*"]
  [log where message : "*OutOfMemoryError*"]

Splunk SPL Query

index=app_logs sourcetype=java_application (CommandLine="*ConnectBot*" OR CommandLine="*connectbot*")
    ("java.lang.OutOfMemoryError" OR "uncaught exception" OR "OutOfMemoryError")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, CommandLine
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="connectbot,cve-2026-54700,">
  <rule id="100547" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">OutOfMemoryError</field>
    <description>CVE-2026-54700: ConnectBot SSH client OutOfMemoryError - possible malformed SSH packet DoS</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
  <rule id="100548" level="6">
    <if_sid>100547</if_sid>
    <field name="process">ConnectBot</field>
    <description>CVE-2026-54700: OutOfMemoryError observed in ConnectBot process</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, CVE patch reference, or OSV package entry was provided in the source data.

1. Immediate mitigations

• Upgrade to ConnectBot SSH Client Library 0.3.1 or later as directed by NVD; this is the version documented as containing the fix.
• Until upgrade, restrict client connections to trusted, controlled SSH servers and, where feasible, disable SSH agent forwarding to eliminate the additional agent-message attack path.
• Avoid connecting ConnectBot-based clients to untrusted or third-party SSH endpoints.
• Deploy detection coverage (see Detection Guidance) for client-side OutOfMemoryError and abnormal SSH packet framing to identify attempts against unpatched clients.
• Monitor client availability and session drops for crashes consistent with uncaught OutOfMemoryError.

2. Patch / upgrade steps

• Identify all applications embedding the ConnectBot SSH Client Library and determine embedded library versions.
• Update the library dependency to 0.3.1 or later and rebuild/redeploy affected applications.
• Confirm no transitive constraints pin the library below 0.3.1.
• Re-test SSH connectivity against both trusted and untrusted endpoints post-upgrade.

3. Long-term hardening

• Enforce strict input validation for all peer-supplied lengths and element counts: verify declared inner sizes against the containing packet bounds before allocating or iterating (treat this as a defensive coding requirement for protocol parsers).
• Add fuzz testing of the SSH parser (including Kaitai Struct-generated parsers) against malformed packets and oversized declarations.
• Catch and safely handle OutOfMemoryError and other uncaught throwable conditions at the protocol-handling boundary so a single malformed packet cannot terminate the whole process.
• Maintain an SSH client inventory and enforce timely dependency updates for protocol-parsing libraries.

References

1. NVD — CVE-2026-54700: https://nvd.nist.gov/vuln/detail/CVE-2026-54700
2. NVD CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
3. Kaitai Struct project: https://kaitai.io/
4. CISA Known Exploited Vulnerabilities catalog (verify whether CVE-2026-54700 is added): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (score pending for CVE-2026-54700): https://www.first.org/epss/

Threat actor campaigns / exploit-in-the-wild evidence: None reported in the provided data. No public PoC, exploit code, or Nuclei template is known for CVE-2026-54700, and the CVE is not listed in CISA KEV as of this report.