CVE-2026-62949: AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION
Summary
A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION (server→client) or SSHMSGCHANNELOPEN (client→server). AsyncSSH stores the peer-supplied value verbatim with no lower-bound check; the first time channel data is written, SSHChannel.flushsendbuf enters a synchronous infinite loop that cannot be interrupted by asyncio.waitfor or any timeout. The loop body has no await, so it blocks the entire asyncio event loop — for a server, one malicious authenticated channel freezes all current and future connections.
RFC 4254 §5.1 leaves receiver behavior for a peer-reported "maximum packet size = 0" undefined, so the value must be rejected rather than stored.
Root cause
asyncssh/channel.py:
python processopen (server side) -- line 465 self.sendpktsize = sendpktsize # peer value, no >= 1 check
processopenconfirmation (client) -- line 528 self.sendpktsize = sendpktsize # peer value, no >= 1 check
flushsendbuf -- lines 305-320 while self.sendbuf and self.sendwindow: pktsize = min(self.sendwindow, self.sendpktsize) # 0 when peer sends 0 buf, datatype = self.sendbuf[0] if len(buf) > pktsize: # True for any buffered data data = buf[:pktsize] # empty (b'') del buf[:pktsize] # no-op ... self.sendwindow -= len(data) # -= 0, unchanged
With sendpktsize == 0, pktsize is 0, so buf[:0] is empty, del buf[:0] is a no-op, and sendwindow is never decremented — the while condition is permanently true, and with no await in the body the event loop is blocked.
Impact
- Client vector (primary): a malicious SSH server replies to the client's channel open with maximum packet size = 0; the client wedges on its first channel write. The attacker is the server, so it needs no valid credentials. - Server vector: an authenticated client opens a channel with maximum packet size = 0; any server-side channel write wedges the AsyncSSH server's event loop, freezing every current and future connection. A single low-privilege account can take the whole server down.
Both vectors are a single SSH message, deterministic, and cause total availability loss for the affected process.
Affected versions
<= 2.23.1 (latest release, 2026-06-06); also present on master (channel.py:465/528 unguarded). Verified end-to-end on 2.23.1.
Verification
The maintainer's proposed fix (reject sendpktsize == 0 in connection.py processchannelopen / processchannelopenconfirmation) was applied to 2.23.1 and re-tested end-to-end over TCP:
- Unpatched: malicious server (paramiko forcing maxpacketsize=0 in OPENCONFIRMATION) + real asyncssh client → client event loop wedges. - Patched: the guard fires inside processchannelopenconfirmation, the malicious value is rejected, the connection closes cleanly (ChannelOpenError: SSH connection closed), and the client does not wedge.
The maintainer (Ron Frederick) independently confirmed the freeze and noted that even shutting the server down does not break clients out of the loop.
Reproducers available: a focused harness driving the real SSHChannel.flushsendbuf with sendpktsize=0, and an end-to-end maliciousserver.py (paramiko) + client.py (real asyncssh) pair. The end-to-end client repro uses asyncio.neweventloop() (not geteventloop()) for Python 3.14 compatibility.
Suggested fix (maintainer's approach)
In connection.py, after each sendpktsize = packet.getuint32() in processchannelopen and processchannelopenconfirmation:
python if sendpktsize == 0: raise ProtocolError('Invalid maximum packet size')
CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5 Medium). An earlier draft quoted 7.5 High ("100% CPU"); the synchronous loop burns ~100% of one core's worth of CPU but, being single-threaded, the OS scheduler spreads it across cores, so the real impact is event-loop / connection freeze, not machine-wide CPU exhaustion.
References
- RFC 4254 §5.1 (channel "maximum packet size"; behavior for 0 is undefined). - The same maximum packet size = 0 send-loop wedge was confirmed in several other independent SSH implementations (different languages/runtimes) and reported to each maintainer separately.
Credits
Reported by zhangph (afldl), 2026-06-20.
Other sources
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of zero. When channel data reaches SSHChannel.flushsendbuf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSHMSGCHANNELOPENCONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSHMSGCHANNELOPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/asyncsshto a version that resolves this vulnerability.Fixed in 2.24.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.24.0 - Configuration
In asyncssh/connection.py inside _process_channel_open and _process_channel_open_confirmation, reject a peer-supplied maximum packet size of 0 (raise ProtocolError('Invalid maximum packet size')) instead of storing self._send_pktsize = send_pktsize / leaving _send_pktsize == 0.
AsyncSSH (connection.py) send_pktsize / maximum packet size = reject send_pktsize == 0
Event History
Frequently Asked Questions
Which deployments are exposed to the client and server attack paths?
AsyncSSH clients can be frozen by a malicious SSH server. AsyncSSH servers can be frozen by an authenticated client, affecting every current and future connection handled by that process.
What does an attacker need to do to trigger the denial of service?
A malicious server can send SSH_MSG_CHANNEL_OPEN_CONFIRMATION with a maximum packet size of zero before the client’s first channel write. An authenticated client can send SSH_MSG_CHANNEL_OPEN with a zero send_pktsize to trigger the server-side path.
What is the impact once exploitation succeeds?
The zero packet size causes a synchronous send-buffer loop which never makes progress and has no await point. This freezes the asyncio event loop, producing a denial of service.
Which versions fix the issue?
The issue is fixed in AsyncSSH 2.24.0. Versions prior to 2.24.0 are affected according to the available information.