ConnectBot SSH Client Library excessive memory allocation in SSH parser

Executive brief

The ConnectBot SSH library, used to facilitate secure remote connections in applications, is vulnerable to a denial-of-service attack. A malicious or compromised server can send a specially crafted, small message that forces the client application to attempt a massive memory allocation. This can lead to the application crashing or becoming unresponsive due to an OutOfMemoryError, disrupting operations and service availability.

Technical details

The SSH protocol parser in ConnectBot's sshlib (via Kaitai Struct Java runtime) fails to validate attacker-controlled length and count fields against the actual size of the containing packet. An attacker-controlled SSH server can send a small packet with an internal field declaring a very large length (up to 32-bit unsigned integer limits). The library attempts to allocate a byte array for this field before verifying if the data exists, leading to excessive heap allocation or an OutOfMemoryError. This vulnerability can be triggered during initial connection or via malformed agent protocol messages if SSH agent forwarding is enabled. The issue is fixed in version 0.3.1 by validating field lengths and element counts against the remaining bytes in the input stream.

Affected products

• ConnectBot sshlib <= 0.3.0

Timeline

• 2026-06-11: patched: Version 0.3.1 released
• 2026-06-12: advisory: GitHub Advisory GHSA-ch3q-cw5r-f4hg published

References

• https://api.github.com/users/kruton
• https://github.com/kruton
• https://api.github.com/users/kruton/gists%7B/gist_id%7D
• https://api.github.com/users/kruton/repos
• https://avatars.githubusercontent.com/u/50407?v=4
• https://api.github.com/users/kruton/events%7B/privacy%7D