Vulnerability Database

352,427

Total vulnerabilities in the database

ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation — org.connectbot.sshlib / sshlib

Improper Input Validation

Summary

The SSH protocol parser trusted attacker-controlled length and count fields without first checking that the declared values fit within the containing packet.

When a client connects to a malicious or compromised SSH server, the server can send a small, malformed packet containing an inner field whose declared length is much larger than the packet itself. The Kaitai Struct Java runtime attempts to allocate a byte array using the declared length before it discovers that the input is truncated. A sufficiently large value can therefore cause excessive memory allocation or an uncaught OutOfMemoryError, potentially terminating the application process that uses the library.

Applications that enable SSH agent forwarding have an additional attack path: the connected server can send malformed agent protocol messages containing the same class of oversized inner length.

Details

SSH uses unsigned 32-bit length prefixes for strings and other protocol structures. Before the fix, several Kaitai Struct definitions passed these lengths directly to generated parsing code. For example, the byte-string definition read a uint32 followed by an array of that size without validating the size against the bytes remaining in the current stream.

The SSH transport limits the size of an outer packet, but an inner field in that packet could still declare a length approaching the Java array size limit. The Kaitai runtime allocates the destination array before reading from the bounded input stream. Consequently, an attacker does not need to transmit an equally large packet to trigger the allocation attempt.

Malformed count fields could also cause parsers to attempt an unreasonable number of repeated elements. The fix validates both byte lengths and element counts against the size of their containing stream.

Parsing failures previously surfaced inconsistently as unchecked runtime exceptions. The fixed version converts malformed SSH packets to a transport protocol error and returns an SSH agent failure response for malformed agent requests.

Attack Requirements

For the general SSH packet path:

  • A user or application must initiate a connection to an attacker-controlled or compromised SSH server.
  • Authentication is not required.
  • No optional library feature is required.
  • The server only needs to return a malformed SSH packet containing an oversized inner length or count.

For the agent protocol path, SSH agent forwarding must additionally be enabled.

Impact

Successful exploitation can cause excessive heap allocation and loss of availability of the application process. In constrained environments, a single small malicious packet can cause an OutOfMemoryError.

No confidentiality or integrity impact has been demonstrated.

Remediation

Upgrade to version 0.3.1 or later.

The fix:

  • Validates length-prefixed fields against the remaining bytes in their containing Kaitai stream.
  • Validates repeated-element counts against the minimum encoded size of each element.
  • Validates SSH transport and agent frame lengths and padding constraints.
  • Converts malformed SSH packet parsing failures into TransportException.
  • Returns SSH_AGENT_FAILURE for malformed forwarded-agent requests instead of allowing parser exceptions to escape.
  • Published: Jun 12, 2026
  • Updated: Jun 13, 2026
  • GHSA: GHSA-ch3q-cw5r-f4hg
  • Severity: Medium
  • Exploit:
  • CISA KEV:

No technical information available.

CWEs:

Software From Fixed in
Maven icon org.connectbot.sshlib / sshlib - 0.3.0.x

Frequently Asked Questions

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.