CVE-2026-54700
Description
A flaw was found in ConnectBot SSH Client Library. The Secure Shell (SSH) protocol parser fails to verify that declared field lengths and element counts fit within the received packet before allocating memory. A malicious or compromised SSH server can exploit this flaw by sending a small malformed packet with oversized length declarations to a connecting client. This can cause excessive memory allocation, resulting in application termination and a Denial of Service (DoS).
Statement
Red Hat has evaluated this vulnerability as having a Moderate severity impact because triggering the flaw requires an active connection to an untrusted or compromised remote server, and the consequence is confined to an application crash without data leakage or unauthorized modification. ConnectBot is an SSH client library primarily designed for Kotlin and Android runtimes and is not included or supported in Red Hat enterprise product distributions. Consequently, standard Red Hat enterprise environments do not expose services or workloads to this flaw under default configurations.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Memory; Modify Memory; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
