SB2026103046 - Resource exhaustion in KDE Connect Android

Description

This security bulletin contains information about 1 vulnerability.

1) Resource exhaustion (CVE-ID: CVE-2026-111431)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to crash KDE Connect Android repeatedly, causing a denial of service.

The vulnerability exists due to improper handling of deeply nested JSON in KDE Connect Android's packet processing when parsing incoming packets. A remote attacker on the local network can send packets containing deeply nested JSON to crash the application and repeat the attack after Android restarts it to sustain a denial of service.

Remediation

Install update from vendor's website.

References

• https://kde.org/info/security/advisory-20261030-1.txt
• https://invent.kde.org/network/kdeconnect-android/-/commit/17778d6d47664e9836a65e6d02414adcf0baff74