Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-62949— AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Quick assessment

Affected
ronf asyncssh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞描述翻译（中文）： AsyncSSH 是一个 Python 包，基于 Python 的 asyncio 框架实现了 SSHv2 协议的异步客户端和服务器端。在 2.24.0 版本之前， 中的 和 会接受由对端提供的 值为 0。当通道数据到达 中的 时，该值为 0 会导致每次循环迭代都切片并移除 0 字节，且不会缩小发送窗口，从而使同步循环永久保持为真，并且没有等待点（await point）。一个恶意的 SSH 服务器可以通过在首次通道写入之前发送 来触发客户端路径；而经过身份验证的客户端则可以通过发送 来触发

CVSS 6.5 · Medium EPSS 0.39% · P33

Affected Version Matrix 1

VendorProduct Version RangeStatus
ronf asyncssh < 2.24.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62949

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION
Source: CVE Program / CVE List V5
Vulnerability Description
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ronf asyncssh < 2.24.0 -

II. Public POCs for CVE-2026-62949

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62949

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-62949 (2)

Other References for CVE-2026-62949 (2)

IV. Related Vulnerabilities

Same product: asyncssh
Same vendor: ronf
Same weakness: CWE-835

V. Comments for CVE-2026-62949

No comments yet

Leave a comment