ConnectBot SSH Client Library accepts excessively long DER length octets in private key parsing, accumulating them into a 32‑bit integer without bounds checking. When an attacker supplies a crafted private‑key file, the library can wrap the length integer, allocate arrays larger than the available input, and ultimately trigger an OutOfMemoryError. While no confidentiality or integrity compromise has been demonstrated, the result is a denial of service that could exhaust system memory or cause the application to crash. This weakness manifests as integer overflow (CWE‑190) and improper input handling leading to out‑of‑range allocations (CWE‑789).

All versions of the ConnectBot SSH client library prior to 0.3.1 are affected. The vulnerability exists in the DerReader.readLength() component of the Kotlin implementation and is triggered when SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() process an attacker‑supplied key. The issue does not affect SSH server host keys or agent‑forwarding messages.

The CVSS score of 6.7 indicates a medium severity, and no exploitation probability metric is provided, so the real‑world exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is either a local user who can provide a malicious private‑key file or an application that processes untrusted key files from an external source. Exploitation would lead to a denial‑of‑service condition rather than code execution or data exfiltration.