Critical Vulnerability in Python AsyncSSH Package: Denial of Service Risk
Summary
DEBIAN-CVE-2026-62949: AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Affects python-asyncssh versions 2.10.1-2 – 2.24.0-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AsyncSSH is a Python package that provides an asynchronous client and server implementation of the SSHv2 protocol, leveraging the Python asyncio framework. It is widely used for secure shell operations in Python applications, allowing developers to create efficient and scalable SSH clients and servers. However, prior to version 2.24.0, AsyncSSH had a significant vulnerability that could lead to denial of service, affecting the stability of applications relying on this package.
Vulnerability Detail
The vulnerability arises from the handling of a peer-supplied send_pktsize value of zero in the _process_channel_open and _process_channel_open_confirmation methods within asyncssh/connection.py. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes the loop to slice and remove zero bytes without reducing the send window, resulting in an infinite loop. This can be exploited by a malicious SSH server to freeze the client or by an authenticated client to freeze the server, impacting all current and future connections handled by the process.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing connection timeouts or limiting the number of concurrent connections to your SSH server. This can help reduce the impact of potential denial of service attacks until you can update to the patched version.
Conclusion
The vulnerability in the AsyncSSH package poses a significant risk of denial of service, affecting applications that rely on this library for SSH operations. It is crucial to update to version 2.24.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-asyncssh →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Exploitation of this vulnerability can lead to denial of service, freezing all current and future SSH connections handled by the affected process.
Yes, you should upgrade to AsyncSSH version 2.24.0 or later to ensure that the vulnerability is patched.
If immediate updating is not possible, consider implementing connection timeouts or limiting concurrent connections as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-asyncssh.
