CVE-2026-62949: AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of zero. When channel data reaches SSHChannel.flushsendbuf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSHMSGCHANNELOPENCONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSHMSGCHANNELOPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
asyncsshto a version that resolves this vulnerability.Fixed in 2.24.0
Event History
Frequently Asked Questions
Which deployments are exposed to the client and server attack paths?
AsyncSSH clients can be frozen by a malicious SSH server. AsyncSSH servers can be frozen by an authenticated client, affecting every current and future connection handled by that process.
What does an attacker need to do to trigger the denial of service?
A malicious server can send SSH_MSG_CHANNEL_OPEN_CONFIRMATION with a maximum packet size of zero before the client’s first channel write. An authenticated client can send SSH_MSG_CHANNEL_OPEN with a zero send_pktsize to trigger the server-side path.
What is the impact once exploitation succeeds?
The zero packet size causes a synchronous send-buffer loop which never makes progress and has no await point. This freezes the asyncio event loop, producing a denial of service.
Which versions fix the issue?
The issue is fixed in AsyncSSH 2.24.0. Versions prior to 2.24.0 are affected according to the available information.