CVE-2026-54697

Name of the Vulnerable Software and Affected Versions ConnectBot SSH Client Library versions prior to 0.3.1

Description The DER parser used for application-supplied private keys fails to safely validate encoded length values before converting them to Int values or allocating arrays. In the DerReader.readLength() function and primitive readers like readInteger(), the system accepts excessive long-form DER length octets that can lead to integer wraparound or excessive memory allocation. This occurs when an application or user loads a malformed private-key file through the following endpoints: SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey(). Such an action can trigger an uncaught OutOfMemoryError, potentially terminating the application process and causing a loss of availability. This issue is not remotely exploitable by an SSH server as it requires the loading of an attacker-provided private-key file.

Recommendations Update ConnectBot SSH Client Library to version 0.3.1.