Vulnerability-Lookup

CVE-2026-62949 (GCVE-0-2026-62949)

Vulnerability from cvelistv5 – Published: 2026-09-16 20:00 – Updated: 2026-09-17 15:01

Title

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Summary

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 15:01 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/ronf/asyncssh/security/advisor…	x_refsource_CONFIRM
https://github.com/ronf/asyncssh/commit/756cbae53…	x_refsource_MISC
https://github.com/ronf/asyncssh/commit/9c354270c…	x_refsource_MISC
https://github.com/ronf/asyncssh/releases/tag/v2.24.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
ronf	asyncssh	Affected: < 2.24.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62949",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T15:01:41.382412Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T15:01:48.863Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "asyncssh",
          "vendor": "ronf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.24.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:00:46.657Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3"
        },
        {
          "name": "https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8"
        },
        {
          "name": "https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67"
        },
        {
          "name": "https://github.com/ronf/asyncssh/releases/tag/v2.24.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ronf/asyncssh/releases/tag/v2.24.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rw4j-r22c-9gc3",
        "discovery": "UNKNOWN"
      },
      "title": "AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62949",
    "datePublished": "2026-09-16T20:00:46.657Z",
    "dateReserved": "2026-07-14T22:32:17.731Z",
    "dateUpdated": "2026-09-17T15:01:48.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-62949",
      "date": "2026-09-17",
      "epss": "0.00388",
      "percentile": "0.32661"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "asyncssh",
                "vendor": "ronf",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.24.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0."
          }
        ],
        "id": "CVE-2026-62949",
        "lastModified": "2026-09-17T16:17:34.413",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-62949",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T15:01:41.382412Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-16T20:17:26.220",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ronf/asyncssh/releases/tag/v2.24.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-835"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T20:50:43+00:00",
      "cve": "CVE-2026-62949",
      "id": "CVE-2026-62949",
      "initial_release_date": "2026-09-16T20:00:46.657000+00:00",
      "product_status:known_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "asyncssh: AsyncSSH: Denial of Service via zero-sized SSH packets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-62949.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:48:51Z",
      "cve": "CVE-2026-62949",
      "id": "CVE-2026-62949",
      "initial_release_date": "2026-09-18T00:48:51Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-62949",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-62949.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-62949",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-17T15:01:41.382412Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-17T15:01:45.695Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "asyncssh",
              "vendor": "ronf",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.24.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-835",
                  "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-16T20:00:46.657Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3"
            },
            {
              "name": "https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8"
            },
            {
              "name": "https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67"
            },
            {
              "name": "https://github.com/ronf/asyncssh/releases/tag/v2.24.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/ronf/asyncssh/releases/tag/v2.24.0"
            }
          ],
          "source": {
            "advisory": "GHSA-rw4j-r22c-9gc3",
            "discovery": "UNKNOWN"
          },
          "title": "AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-62949",
        "datePublished": "2026-09-16T20:00:46.657Z",
        "dateReserved": "2026-07-14T22:32:17.731Z",
        "dateUpdated": "2026-09-16T20:00:46.657Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-62949

Vulnerability from fkie_nvd - Published: 2026-09-16 20:17 - Updated: 2026-09-17 16:17

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8
	security-advisories@github.com	https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67
	security-advisories@github.com	https://github.com/ronf/asyncssh/releases/tag/v2.24.0
	security-advisories@github.com	https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "asyncssh",
          "vendor": "ronf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.24.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0."
    }
  ],
  "id": "CVE-2026-62949",
  "lastModified": "2026-09-17T16:17:34.413",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-62949",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-17T15:01:41.382412Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-16T20:17:26.220",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ronf/asyncssh/releases/tag/v2.24.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RW4J-R22C-9GC3

Vulnerability from github – Published: 2026-09-17 14:53 – Updated: 2026-09-17 14:53

Summary

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Details

Summary

A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSH_MSG_CHANNEL_OPEN_CONFIRMATION (server→client) or SSH_MSG_CHANNEL_OPEN (client→server). AsyncSSH stores the peer-supplied value verbatim with no lower-bound check; the first time channel data is written, SSHChannel._flush_send_buf enters a synchronous infinite loop that cannot be interrupted by asyncio.wait_for or any timeout. The loop body has no await, so it blocks the entire asyncio event loop — for a server, one malicious authenticated channel freezes all current and future connections.

RFC 4254 §5.1 leaves receiver behavior for a peer-reported "maximum packet size = 0" undefined, so the value must be rejected rather than stored.

Root cause

asyncssh/channel.py:

# process_open (server side)        -- line 465
self._send_pktsize = send_pktsize    # peer value, no >= 1 check

# process_open_confirmation (client) -- line 528
self._send_pktsize = send_pktsize    # peer value, no >= 1 check

# _flush_send_buf                    -- lines 305-320
while self._send_buf and self._send_window:
    pktsize = min(self._send_window, self._send_pktsize)  # 0 when peer sends 0
    buf, datatype = self._send_buf[0]
    if len(buf) > pktsize:          # True for any buffered data
        data = buf[:pktsize]        # empty (b'')
        del buf[:pktsize]           # no-op
    ...
    self._send_window -= len(data)  # -= 0, unchanged

With _send_pktsize == 0, pktsize is 0, so buf[:0] is empty, del buf[:0] is a no-op, and _send_window is never decremented — the while condition is permanently true, and with no await in the body the event loop is blocked.

Impact

Client vector (primary): a malicious SSH server replies to the client's channel open with maximum packet size = 0; the client wedges on its first channel write. The attacker is the server, so it needs no valid credentials.
Server vector: an authenticated client opens a channel with maximum packet size = 0; any server-side channel write wedges the AsyncSSH server's event loop, freezing every current and future connection. A single low-privilege account can take the whole server down.

Both vectors are a single SSH message, deterministic, and cause total availability loss for the affected process.

Affected versions

<= 2.23.1 (latest release, 2026-06-06); also present on master (channel.py:465/528 unguarded). Verified end-to-end on 2.23.1.

Verification

The maintainer's proposed fix (reject send_pktsize == 0 in connection.py _process_channel_open / _process_channel_open_confirmation) was applied to 2.23.1 and re-tested end-to-end over TCP:

Unpatched: malicious server (paramiko forcing max_packet_size=0 in OPEN_CONFIRMATION) + real asyncssh client → client event loop wedges.
Patched: the guard fires inside _process_channel_open_confirmation, the malicious value is rejected, the connection closes cleanly (ChannelOpenError: SSH connection closed), and the client does not wedge.

The maintainer (Ron Frederick) independently confirmed the freeze and noted that even shutting the server down does not break clients out of the loop.

Reproducers available: a focused harness driving the real SSHChannel._flush_send_buf with _send_pktsize=0, and an end-to-end malicious_server.py (paramiko) + client.py (real asyncssh) pair. The end-to-end client repro uses asyncio.new_event_loop() (not get_event_loop()) for Python 3.14 compatibility.

Suggested fix (maintainer's approach)

In connection.py, after each send_pktsize = packet.get_uint32() in _process_channel_open and _process_channel_open_confirmation:

if send_pktsize == 0:
    raise ProtocolError('Invalid maximum packet size')

CVSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5 Medium). An earlier draft quoted 7.5 High ("100% CPU"); the synchronous loop burns ~100% of one core's worth of CPU but, being single-threaded, the OS scheduler spreads it across cores, so the real impact is event-loop / connection freeze, not machine-wide CPU exhaustion.

References

RFC 4254 §5.1 (channel "maximum packet size"; behavior for 0 is undefined).
The same maximum packet size = 0 send-loop wedge was confirmed in several other independent SSH implementations (different languages/runtimes) and reported to each maintainer separately.

Credits

Reported by zhangph (afldl), 2026-06-20. ```

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.23.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "asyncssh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T14:53:01Z",
    "nvd_published_at": "2026-09-16T20:17:26Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA malicious SSH server can wedge an AsyncSSH **client**, and an authenticated\nclient can wedge an AsyncSSH **server**, by sending a channel `maximum packet\nsize` of `0` in `SSH_MSG_CHANNEL_OPEN_CONFIRMATION` (server\u2192client) or\n`SSH_MSG_CHANNEL_OPEN` (client\u2192server). AsyncSSH stores the peer-supplied value\nverbatim with no lower-bound check; the first time channel data is written,\n`SSHChannel._flush_send_buf` enters a **synchronous infinite loop** that cannot\nbe interrupted by `asyncio.wait_for` or any timeout. The loop body has no\n`await`, so it blocks the entire asyncio event loop \u2014 for a server, one\nmalicious authenticated channel freezes **all** current and future connections.\n\nRFC 4254 \u00a75.1 leaves receiver behavior for a peer-reported \"maximum packet\nsize = 0\" undefined, so the value must be rejected rather than stored.\n\n## Root cause\n\n`asyncssh/channel.py`:\n\n```python\n# process_open (server side)        -- line 465\nself._send_pktsize = send_pktsize    # peer value, no \u003e= 1 check\n\n# process_open_confirmation (client) -- line 528\nself._send_pktsize = send_pktsize    # peer value, no \u003e= 1 check\n\n# _flush_send_buf                    -- lines 305-320\nwhile self._send_buf and self._send_window:\n    pktsize = min(self._send_window, self._send_pktsize)  # 0 when peer sends 0\n    buf, datatype = self._send_buf[0]\n    if len(buf) \u003e pktsize:          # True for any buffered data\n        data = buf[:pktsize]        # empty (b\u0027\u0027)\n        del buf[:pktsize]           # no-op\n    ...\n    self._send_window -= len(data)  # -= 0, unchanged\n```\n\nWith `_send_pktsize == 0`, `pktsize` is `0`, so `buf[:0]` is empty,\n`del buf[:0]` is a no-op, and `_send_window` is never decremented \u2014 the\n`while` condition is permanently true, and with no `await` in the body the\nevent loop is blocked.\n\n## Impact\n\n- **Client vector (primary):** a malicious SSH server replies to the client\u0027s\n  channel open with `maximum packet size = 0`; the client wedges on its first\n  channel write. The attacker is the server, so it needs no valid credentials.\n- **Server vector:** an authenticated client opens a channel with\n  `maximum packet size = 0`; any server-side channel write wedges the AsyncSSH\n  server\u0027s event loop, freezing **every** current and future connection. A\n  single low-privilege account can take the whole server down.\n\nBoth vectors are a single SSH message, deterministic, and cause total\navailability loss for the affected process.\n\n## Affected versions\n\n\u003c= 2.23.1 (latest release, 2026-06-06); also present on `master`\n(channel.py:465/528 unguarded). Verified end-to-end on 2.23.1.\n\n## Verification\n\nThe maintainer\u0027s proposed fix (reject `send_pktsize == 0` in `connection.py`\n`_process_channel_open` / `_process_channel_open_confirmation`) was applied to\n2.23.1 and re-tested end-to-end over TCP:\n\n- **Unpatched:** malicious server (paramiko forcing `max_packet_size=0` in\n  OPEN_CONFIRMATION) + real asyncssh client \u2192 client event loop wedges.\n- **Patched:** the guard fires inside `_process_channel_open_confirmation`, the\n  malicious value is rejected, the connection closes cleanly\n  (`ChannelOpenError: SSH connection closed`), and the client does **not** wedge.\n\nThe maintainer (Ron Frederick) independently confirmed the freeze and noted that\n**even shutting the server down does not break clients out of the loop**.\n\nReproducers available: a focused harness driving the real\n`SSHChannel._flush_send_buf` with `_send_pktsize=0`, and an end-to-end\n`malicious_server.py` (paramiko) + `client.py` (real asyncssh) pair. The\nend-to-end client repro uses `asyncio.new_event_loop()` (not `get_event_loop()`)\nfor Python 3.14 compatibility.\n\n## Suggested fix (maintainer\u0027s approach)\n\nIn `connection.py`, after each `send_pktsize = packet.get_uint32()` in\n`_process_channel_open` and `_process_channel_open_confirmation`:\n\n```python\nif send_pktsize == 0:\n    raise ProtocolError(\u0027Invalid maximum packet size\u0027)\n```\n\n## CVSS\n\n`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` (6.5 Medium). An earlier draft\nquoted 7.5 High (\"100% CPU\"); the synchronous loop burns ~100% of one core\u0027s\nworth of CPU but, being single-threaded, the OS scheduler spreads it across\ncores, so the real impact is event-loop / connection freeze, not machine-wide\nCPU exhaustion.\n\n## References\n\n- RFC 4254 \u00a75.1 (channel \"maximum packet size\"; behavior for 0 is undefined).\n- The same `maximum packet size = 0` send-loop wedge was confirmed in several\n  other independent SSH implementations (different languages/runtimes) and\n  reported to each maintainer separately.\n\n## Credits\n\nReported by zhangph (afldl), 2026-06-20.\n```",
  "id": "GHSA-rw4j-r22c-9gc3",
  "modified": "2026-09-17T14:53:01Z",
  "published": "2026-09-17T14:53:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ronf/asyncssh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ronf/asyncssh/releases/tag/v2.24.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-62949 (GCVE-0-2026-62949)

FKIE_CVE-2026-62949

GHSA-RW4J-R22C-9GC3

Summary

Root cause

Impact

Affected versions

Verification

Suggested fix (maintainer's approach)

CVSS

References

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour