Summary

A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION (server→client) or SSHMSGCHANNELOPEN (client→server). AsyncSSH stores the peer-supplied value verbatim with no lower-bound check; the first time channel data is written, SSHChannel.flushsendbuf enters a synchronous infinite loop that cannot be interrupted by asyncio.waitfor or any timeout. The loop body has no await, so it blocks the entire asyncio event loop — for a server, one malicious authenticated channel freezes all current and future connections.

RFC 4254 §5.1 leaves receiver behavior for a peer-reported "maximum packet size = 0" undefined, so the value must be rejected rather than stored.

Root cause

asyncssh/channel.py:

python processopen (server side) -- line 465 self.sendpktsize = sendpktsize # peer value, no >= 1 check

processopenconfirmation (client) -- line 528 self.sendpktsize = sendpktsize # peer value, no >= 1 check

flushsendbuf -- lines 305-320 while self.sendbuf and self.sendwindow: pktsize = min(self.sendwindow, self.sendpktsize) # 0 when peer sends 0 buf, datatype = self.sendbuf[0] if len(buf) > pktsize: # True for any buffered data data = buf[:pktsize] # empty (b'') del buf[:pktsize] # no-op ... self.sendwindow -= len(data) # -= 0, unchanged

With sendpktsize == 0, pktsize is 0, so buf[:0] is empty, del buf[:0] is a no-op, and sendwindow is never decremented — the while condition is permanently true, and with no await in the body the event loop is blocked.

Impact

- Client vector (primary): a malicious SSH server replies to the client's channel open with maximum packet size = 0; the client wedges on its first channel write. The attacker is the server, so it needs no valid credentials. - Server vector: an authenticated client opens a channel with maximum packet size = 0; any server-side channel write wedges the AsyncSSH server's event loop, freezing every current and future connection. A single low-privilege account can take the whole server down.

Both vectors are a single SSH message, deterministic, and cause total availability loss for the affected process.

Affected versions

<= 2.23.1 (latest release, 2026-06-06); also present on master (channel.py:465/528 unguarded). Verified end-to-end on 2.23.1.

Verification

The maintainer's proposed fix (reject sendpktsize == 0 in connection.py processchannelopen / processchannelopenconfirmation) was applied to 2.23.1 and re-tested end-to-end over TCP:

- Unpatched: malicious server (paramiko forcing maxpacketsize=0 in OPENCONFIRMATION) + real asyncssh client → client event loop wedges. - Patched: the guard fires inside processchannelopenconfirmation, the malicious value is rejected, the connection closes cleanly (ChannelOpenError: SSH connection closed), and the client does not wedge.

The maintainer (Ron Frederick) independently confirmed the freeze and noted that even shutting the server down does not break clients out of the loop.

Reproducers available: a focused harness driving the real SSHChannel.flushsendbuf with sendpktsize=0, and an end-to-end maliciousserver.py (paramiko) + client.py (real asyncssh) pair. The end-to-end client repro uses asyncio.neweventloop() (not geteventloop()) for Python 3.14 compatibility.

Suggested fix (maintainer's approach)

In connection.py, after each sendpktsize = packet.getuint32() in processchannelopen and processchannelopenconfirmation:

python if sendpktsize == 0: raise ProtocolError('Invalid maximum packet size')

CVSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5 Medium). An earlier draft quoted 7.5 High ("100% CPU"); the synchronous loop burns ~100% of one core's worth of CPU but, being single-threaded, the OS scheduler spreads it across cores, so the real impact is event-loop / connection freeze, not machine-wide CPU exhaustion.

References

- RFC 4254 §5.1 (channel "maximum packet size"; behavior for 0 is undefined). - The same maximum packet size = 0 send-loop wedge was confirmed in several other independent SSH implementations (different languages/runtimes) and reported to each maintainer separately.

Credits

Reported by zhangph (afldl), 2026-06-20.

| | | |---|---| | Product | asyncssh (all versions through 2.23.0) | | Related | CVE-2019-6111 (same class in OpenSSH) | | Fix | AsyncSSH 2.23.1 |

A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP receive path does not currently sanitize server-provided filenames. By chaining directory traversals via the D (directory) action, an attacker can escape any target directory and overwrite ~/.bashrc, ~/.ssh/rc, or ~/.ssh/authorizedkeys, achieving code execution. This is the same vulnerability class as CVE-2019-6111. The mitigation applied in OpenSSH does not appear to have been adopted in asyncssh.

---

Steps to exploit:

Step 1 - Normal usage: Application calls await asyncssh.scp((conn, 'file'), '/home/user/downloads/'). This is the standard, documented API.

Step 2 - SCP protocol: asyncssh opens an SSH exec channel, runs scp -f file. The server controls the filename field:

C0644 100 ../pwned.txt\n (simple traversal)

D0755 0 ..\n (traverse up, repeat as needed) C0644 47 .bashrc\n (write payload) E\n

Step 3 - parsecdargs (scp.py:134-142) returns the filename verbatim:

python def parsecdargs(args: bytes) -> Tuple[int, int, bytes]: permissions, size, name = args.split(None, 2) return int(permissions, 8), int(size), name # no sanitization

The returned name is not passed through basename() and is not checked for .. or / components.

Step 4 - recvfiles (scp.py:706-713) joins the unsanitized name:

python newdstpath = posixpath.join(dstpath, name)

With dstpath=b'/home/user/downloads/subdir' and name=b'../pwned.txt', this resolves to /home/user/downloads/pwned.txt, outside the target.

Step 5 - File write: recvfile opens the traversed path via self.fs.open(dstpath, 'wb') and writes attacker-controlled content. The resolved path is not checked against the target directory boundary.

Step 6 - RCE chains:

| Target | Execution trigger | Reliability | |---|---|---| | ~/.bashrc | Next terminal open | High | | ~/.profile | Next login | High | | ~/.ssh/rc | Next SSH connection (requires sshd) | High | | ~/.ssh/authorizedkeys | Attacker logs in with command= | Medium |

---

Reproduction:

Link to reproduction script: pathtraversalpoc.zip

bash docker build -t asyncssh-scp-traversal -f Dockerfile . docker run --rm asyncssh-scp-traversal

The attached pocscptraversal.py starts a malicious SSH server in-process using asyncssh's own API, then downloads from it via asyncssh.scp().

Expected Output:

<img width="1400" height="815" alt="image" src="https://github.com/user-attachments/assets/496745e4-d11d-4ed8-bddd-d15dd13d1751" />

Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue.