CVE-2026-62949: AsyncSSH Client and Server Event Loop Freeze via Zero Maximum Packet Size
Summary
CVE-2026-62949: A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSH_MSG_CHANNEL_OPEN_CONFIRMATION (server→client) or SSH_MSG... Affects asyncssh versions < 2.24.0. Fixed in 2.24.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AsyncSSH is a Python library that provides an implementation of the SSH protocol, allowing for secure communication over a network. It is widely used for building SSH clients and servers in Python applications. The library supports asynchronous operations, enabling efficient handling of multiple connections. However, a vulnerability exists that allows a malicious SSH server or an authenticated client to exploit the library by sending a maximum packet size of zero, leading to a freeze in the event loop and causing denial of service.
Vulnerability Detail
The vulnerability arises from the lack of validation for the maximum packet size parameter in the AsyncSSH library. When a malicious SSH server sends a channel open confirmation with a maximum packet size of zero, or an authenticated client opens a channel with the same value, the library enters a synchronous infinite loop during data transmission. This loop blocks the entire asyncio event loop, preventing any further operations and effectively freezing all current and future connections. The root cause is found in the handling of the packet size, where the library does not enforce a minimum value, leading to potential denial of service for both clients and servers.
How To Fix
Latest published version: 2.24.1 as of 23 Oct 2026
pip install --upgrade "asyncssh==2.24.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.24.0
This is the first release that contains the fix.
pip install --upgrade "asyncssh==2.24.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a check in your code to validate the maximum packet size before proceeding with any channel operations. For example, you can modify the channel opening logic as follows:
if send_pktsize == 0: raise ProtocolError('Invalid maximum packet size')
Conclusion
The AsyncSSH library has a critical vulnerability that can lead to event loop freezes due to improper handling of maximum packet sizes. It is essential to update to the patched version to mitigate this risk. Additionally, implementing validation checks can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for asyncssh →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to a denial of service, where the affected AsyncSSH client or server becomes unresponsive, freezing all connections.
Yes, the patch is available in AsyncSSH version 2.24.0 and later. Updating to this version will resolve the issue.
If you cannot update the package, implement a validation check for the maximum packet size in your code to prevent the infinite loop.
References
Related vulnerabilities
Recent vulnerabilities recorded for asyncssh.
