EUVD-2026-98839

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining...

CVE-2026-54697 ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining...

CVE-2026-54697

The ConnectBot SSH Client Library (prior to version 0.3.1 ) is vulnerable to an integer overflow and excessive memory allocation in its DER parser. Specifically, DerReader.readLength() fails to safely validate long-form DER length octets before accumulating them into an Int. This allows an attack...

CVE-2026-54697: Integer Overflow or Wraparound

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining...

PT-2026-56686

Name of the Vulnerable Software and Affected Versions ConnectBot SSH Client Library versions prior to 0.3.1 Description The DER parser used for application-supplied private keys fails to safely validate encoded length values before converting them to Int values or allocating arrays. In the...