EUVD-2026-81093

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSHMSGCHANNELOPEN / OPENCONFIRMATION...

pyplanet (>=0.1.5, <=0.3.3) potentially affected by CVE-2026-62949 via asyncssh (1.10.0)

asyncssh PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.1.5, =0.3.3 Source cves: CVE-2026-62949 Source advisory: OSV:GHSA-RW4J-R22C-9GC3...

pyplanet (>=0.6.0rc1, <=0.6.0) potentially affected by CVE-2026-62949 via asyncssh (1.12.2)

asyncssh PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.6.0rc1, =0.6.0 Source cves: CVE-2026-62949 Source advisory: OSV:GHSA-RW4J-R22C-9GC3...

pyplanet (0.6.1a1) potentially affected by CVE-2026-62949 via asyncssh (1.13.2)

asyncssh PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet 0.6.1a1 Source cves: CVE-2026-62949 Source advisory: OSV:GHSA-RW4J-R22C-9GC3...

aioasuswrt (>=1.1.20, <=1.1.21) potentially affected by CVE-2026-62949 via asyncssh (1.15.0)

asyncssh PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - aioasuswrt =1.1.20, =1.1.21 Source cves: CVE-2026-62949 Source advisory: OSV:GHSA-RW4J-R22C-9GC3...

pyplanet (>=0.5.0, <=0.5.2) potentially affected by CVE-2026-62949 via asyncssh (1.11.0)

asyncssh PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.0, =0.5.2 Source cves: CVE-2026-62949 Source advisory: OSV:GHSA-RW4J-R22C-9GC3...

netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2026-62949 via asyncssh (1.18.0)

asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2026-62949 Source advisory: OSV:GHSA-RW4J-R22C-9GC3...

GHSA-RW4J-R22C-9GC3 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client or SSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied value verbatim...

aiida-core (>=2.7.0rc0, <=2.9.2), aiida-gromacs (2.2.2) +103 more potentially affected by CVE-2026-62949 via asyncssh (>=2.0.1, <=2.23.1)

asyncssh PYPI version =2.0.1, =2.7.0rc0, =0.4.1, =0.7.2, =1.2.7, =0.0.1, =1.5.0.dev202411111555, =1.44.2, =0.6.0, =1.7.3, =1.46.0, =0.0.2, =2.0.15, =2.1.8 and more Source cves: CVE-2026-62949 Source advisory: SNYK:PYTHON-ASYNCSSH-19883914...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the SSHMSGCHANNELOPEN and SSHMSGCHANNELOPENCONFIRMATION. An attacker can cause the asyncio event loop to freeze by supplying a sendpktsize value of zero, which leads to an infinite loop that prevents further processing ...

CVE-2026-62949

A flaw was found in AsyncSSH, a Python package for SSHv2 protocol implementation. A malicious SSH server or an authenticated client can exploit this vulnerability by sending a specially crafted SSH packet with a zero-sized maximum packet size. This can cause the AsyncSSH event loop to freeze,...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

DEBIAN-CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

UBUNTU-CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of zero. When channel...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

CVE-2026-62949 affects AsyncSSH , a Python asynchronous SSHv2 implementation. The flaw resides in _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py, which accept a peer-supplied send_pktsize value of zero . When channel data reaches SSHChannel._flush_send_buf,...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...