Asynchronous Client and Server Vulnerability in AsyncSSH by Ron Ferrer

CVE-2026-62949

What is CVE-2026-62949?

The AsyncSSH package, designed for asynchronous SSHv2 communication, has a vulnerability that allows a malicious SSH server to exploit a flaw in the handling of channel open requests. The issue arises when zero bytes are mishandled during packet transmission, leading to a permanent loop that can freeze existing and future connections. This flaw can be triggered by both malicious servers and authenticated clients, causing significant service interruptions. A fix has been implemented in version 2.24.0 to address this issue.

References