MaccaroniC2

MaccaroniC2 - Empowering Command & Control using AsyncSSH MaccaroniC2 is a proof-of-concept Command and Control framework that utilizes the powerful AsyncSSH Python library which provides an asynchronous client and server implementation of the SSHv2 protocol and use PyNgrok wrapper for ngrok...

PYSEC-2026-4026 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client or SSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied value verbatim...

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

SummaryA malicious SSH server can wedge an AsyncSSH client, and an authenticatedclient can wedge an AsyncSSH server, by sending a channel maximum packetsize of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client orSSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied valueverbatim with ...

pyplanet (>=0.0.1, <=0.1.4) potentially affected by CVE-2026-62949 via asyncssh (1.9.0)

asyncssh PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.0.1, =0.1.4 Source cves: CVE-2026-62949 Source advisory: OSV:PYSEC-2026-4026...

pyplanet (>=0.1.5, <=0.3.3) potentially affected by CVE-2026-62949 via asyncssh (1.10.0)

asyncssh PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.1.5, =0.3.3 Source cves: CVE-2026-62949 Source advisory: OSV:PYSEC-2026-4026...

pyplanet (>=0.6.0rc1, <=0.6.0) potentially affected by CVE-2026-62949 via asyncssh (1.12.2)

asyncssh PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.6.0rc1, =0.6.0 Source cves: CVE-2026-62949 Source advisory: OSV:PYSEC-2026-4026...

pyplanet (0.6.1a1) potentially affected by CVE-2026-62949 via asyncssh (1.13.2)

asyncssh PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet 0.6.1a1 Source cves: CVE-2026-62949 Source advisory: OSV:PYSEC-2026-4026...

pitcrew (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-62949 via asyncssh (1.16.1)

asyncssh PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pitcrew =0.0.1, =0.0.3 Source cves: CVE-2026-62949 Source advisory: OSV:PYSEC-2026-4026...

aiida-core (>=2.7.0rc0, <=2.9.2), aiida-gromacs (2.2.2) +103 more potentially affected by CVE-2026-62949 via asyncssh (>=2.0.1, <=2.23.1)

asyncssh PYPI version =2.0.1, =2.7.0rc0, =0.4.1, =0.7.2, =1.2.7, =0.0.1, =1.5.0.dev202411111555, =1.44.2, =0.6.0, =1.7.3, =1.46.0, =0.0.2, =2.0.15, =2.1.8 and more Source cves: CVE-2026-62949 Source advisory: OSV:PYSEC-2026-4026...

pyplanet (>=0.4.0, <=0.4.5) potentially affected by CVE-2026-62949 via asyncssh (1.10.1)

asyncssh PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.4.0, =0.4.5 Source cves: CVE-2026-62949 Source advisory: OSV:PYSEC-2026-4026...

pyplanet (>=0.5.0, <=0.5.2) potentially affected by CVE-2026-62949 via asyncssh (1.11.0)

asyncssh PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.0, =0.5.2 Source cves: CVE-2026-62949 Source advisory: OSV:PYSEC-2026-4026...

PT-2026-105787

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSH MSG CHANNEL OPEN CONFIRMATION server→client or SSH MSG CHANNEL OPEN client→server. AsyncSSH stores the peer-supplied value...

CLEANSTART-2026-LF94693 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

Security vulnerability affects the airflow-3 package. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework...

openSUSE 16 Security Update : python-asyncssh (openSUSE-SU-2026:21953-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21953-1 advisory. Changes in python-asyncssh: - CVE-2026-62949: denial of service via infinite loop when processing zero-sized SSH packets bsc1280972 Tenable has extracte...

CLEANSTART-2026-KI90686 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

CVE-2026-62949 affects multiple packages. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. See references for individual vulnerability details...

OPENSUSE-SU-2026:21953-1 Security update for python-asyncssh

This update for python-asyncssh fixes the following issues: Changes in python-asyncssh: - CVE-2026-62949: denial of service via infinite loop when processing zero-sized SSH packets bsc1280972...

OPENSUSE-SU-2026:11851-1 python313-asyncssh-2.24.0-1.1 on GA media

These are all security issues fixed in the python313-asyncssh-2.24.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

Linux Distros Unpatched Vulnerability : CVE-2026-62949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client or SSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied value verbatim...