AsyncSSH Event Loop Freeze Vulnerability Analysis (GHSA-r46j-r22e-9gc3)

Vulnerability Summary: asyncio Event Loop Freeze (GHSA-r46j-r22e-9gc3) Overview Vulnerability Type: Denial of Service (DoS) Root Cause: A malicious/authenticated SSH server sends within / . Trigger Mechanism: In , is not validated, resulting in . In , the condition evaluates to true but contains no , causing a synchronous infinite loop that freezes the entire asyncio event loop, stalling all connections. Severity: CVSS 3.1 Base Score 6.5/10 (Medium), CWE-885 (Improper Neutralization of Null Values). Impact Scope Affected Package: (python) Affected Versions: <= 2.23.1 (including the master branch as of 2026-06-06) Fixed Version: 2.24.0 Attack Vectors: - Client Vector: A malicious server sends in the initial channel open, freezing the client's event loop. - Server Vector: An authenticated client sends , freezing the server's event loop; a single low-privilege account can take down the entire server process. Impact: Deterministic, instantaneous, and full-process availability loss. Fix Maintainer's Solution: In 's / , validate ; if it is 0, raise . Verification: - Unfixed: A malicious server ( ) causes the event loop of a genuine asyncssh client to freeze. - Fixed: The guard rejects the value, the connection closes cleanly, and the client does not freeze. - Independent Confirmation: Even if the server process is terminated, connected clients will not freeze. POC / Exploit Code References RFC 4254 §5.1: When the channel "maximum packet size" is 0, the value should be rejected rather than stored. Similar send-loop freezes caused by have been reported in multiple independent SSH implementations.

Goal Reached Thanks to every supporter — we hit 100%!

AsyncSSH Event Loop Freeze Vulnerability Analysis (GHSA-r46j-r22e-9gc3)

More from this source