connectbot has 4 CVEs on record. 2 were published in the last 90 days. The median CVSS is 6.8 (medium). The most common weakness class is CWE-789 (4). Most affected products: cbssh (2), org.connectbot.sshlib:sshlib (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 2 prev 2
Worst active — by depth score
CVE-2026-54700Medium· 6.9ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine38CVE-2026-54697Medium· 6.7ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine37GHSA-vc8p-8pxg-rfwgMediumConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing28GHSA-ch3q-cw5r-f4hgMediumConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation28
connectbot vulnerabilities
CVEs affecting connectbot, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-54700Medium· 6.9ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the cont…
CVE-2026-54697Medium· 6.7ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate a…
GHSA-ch3q-cw5r-f4hgMediumConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation
ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation
GHSA-vc8p-8pxg-rfwgMediumConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing
ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing