MaccaroniC2

MaccaroniC2 - AsyncSSH를 사용한 C&C 강화 MaccaroniC2 는 강력한 AsyncSSH Python 라이브러리를 활용하는 개념 증명 Command and Control 프레임워크 입니다. 이 라이브러리는 SSHv2 프로토콜의 비동기 클라이언트 및 서버 구현을 제공하며, PyNgrok 래퍼를 통해 ngrok 통합을 사용합니다. 이 도구는 피해자가 AsyncSSH 서버를 실행하고 외부로 터널을 설정하여 공격자가 명령을 받을 준비가 된 특정 시나리오에서 영감을 받았습니다. 공격자는 Ngrok 공식 API 를...

CLEANSTART-2026-KI90686 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

CVE-2026-62949 affects multiple packages. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. See references for individual vulnerability details...

OPENSUSE-SU-2026:11851-1 python313-asyncssh-2.24.0-1.1 on GA media

These are all security issues fixed in the python313-asyncssh-2.24.0-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-62949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

GHSA-RW4J-R22C-9GC3 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client or SSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied value verbatim...

EUVD-2026-81093

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSHMSGCHANNELOPEN / OPENCONFIRMATION...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the SSHMSGCHANNELOPEN and SSHMSGCHANNELOPENCONFIRMATION. An attacker can cause the asyncio event loop to freeze by supplying a sendpktsize value of zero, which leads to an infinite loop that prevents further processing ...

CVE-2026-62949

A flaw was found in AsyncSSH, a Python package for SSHv2 protocol implementation. A malicious SSH server or an authenticated client can exploit this vulnerability by sending a specially crafted SSH packet with a zero-sized maximum packet size. This can cause the AsyncSSH event loop to freeze,...

DEBIAN-CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

UBUNTU-CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

CVE-2026-62949 affects AsyncSSH , a Python asynchronous SSHv2 implementation. The flaw resides in _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py, which accept a peer-supplied send_pktsize value of zero . When channel data reaches SSHChannel._flush_send_buf,...

CVE-2026-62949: Loop with Unreachable Exit Condition

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-90623

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/sshconnection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely...

CVE-2026-90623 andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/sshconnection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely...