CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

CVE-2026-62949 affects AsyncSSH , a Python asynchronous SSHv2 implementation. The flaw resides in _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py, which accept a peer-supplied send_pktsize value of zero . When channel data reaches SSHChannel._flush_send_buf,...

PT-2026-93998

Name of the Vulnerable Software and Affected Versions AsyncSSH versions prior to 2.24.0 Description AsyncSSH is a Python package providing an asynchronous client and server implementation of the SSHv2 protocol. The software fails to validate the send pktsize value provided by a peer, allowing it ...

CVE-2026-62949: Loop with Unreachable Exit Condition

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-90623

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/sshconnection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely...

CVE-2026-90623 andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/sshconnection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely...

CVE-2026-90623 andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/sshconnection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely...

PT-2026-91041

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/ssh connection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely...

asyncssh has SCP Path Traversal to Arbitrary File Write

| | ||---|---|| Product | asyncssh all versions through 2.23.0 || Related | CVE-2019-6111 same class in OpenSSH || Fix | AsyncSSH 2.23.1 |A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP recei...

PYSEC-2026-3808 asyncssh has SCP Path Traversal to Arbitrary File Write

| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...

pyplanet (>=0.1.5, <=0.3.3) potentially affected by CVE-2026-54590 via asyncssh (1.10.0)

asyncssh PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.1.5, =0.3.3 Source cves: CVE-2026-54590 Source advisory: OSV:PYSEC-2026-3809...

pyplanet (>=0.6.0rc1, <=0.6.0) potentially affected by CVE-2026-54590 via asyncssh (1.12.2)

asyncssh PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.6.0rc1, =0.6.0 Source cves: CVE-2026-54590 Source advisory: OSV:PYSEC-2026-3809...

pyplanet (0.6.1a1) potentially affected by CVE-2026-54591 via asyncssh (1.13.2)

asyncssh PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet 0.6.1a1 Source cves: CVE-2026-54591 Source advisory: OSV:PYSEC-2026-3808...

aioasuswrt (>=1.1.20, <=1.1.21) potentially affected by CVE-2026-54590 via asyncssh (1.15.0)

asyncssh PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - aioasuswrt =1.1.20, =1.1.21 Source cves: CVE-2026-54590 Source advisory: OSV:PYSEC-2026-3809...

pitcrew (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-54591 via asyncssh (1.16.1)

asyncssh PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pitcrew =0.0.1, =0.0.3 Source cves: CVE-2026-54591 Source advisory: OSV:PYSEC-2026-3808...

pitcrew (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-54590 via asyncssh (1.16.1)

asyncssh PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pitcrew =0.0.1, =0.0.3 Source cves: CVE-2026-54590 Source advisory: OSV:PYSEC-2026-3809...

netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2026-54590 via asyncssh (1.18.0)

asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2026-54590 Source advisory: OSV:PYSEC-2026-3809...

aiida-core (>=2.7.0rc0, <=2.9.2), aiida-gromacs (2.2.2) +77 more potentially affected by CVE-2026-54591 via asyncssh (>=2.0.1, <=2.22.0)

asyncssh PYPI version =2.0.1, =2.7.0rc0, =0.4.1, =0.7.2, =1.2.7, =0.0.1, =1.5.0.dev202411111555, =1.44.2, =0.6.0, =1.7.3, =1.46.0, =0.0.2, =0.3.0, =0.6.5 and more Source cves: CVE-2026-54591 Source advisory: OSV:PYSEC-2026-3808...

aiida-core (>=2.7.0rc0, <=2.9.2), aiida-gromacs (2.2.2) +77 more potentially affected by CVE-2026-54590 via asyncssh (>=2.0.1, <=2.22.0)

asyncssh PYPI version =2.0.1, =2.7.0rc0, =0.4.1, =0.7.2, =1.2.7, =0.0.1, =1.5.0.dev202411111555, =1.44.2, =0.6.0, =1.7.3, =1.46.0, =0.0.2, =0.3.0, =0.6.5 and more Source cves: CVE-2026-54590 Source advisory: OSV:PYSEC-2026-3809...

pyplanet (>=0.4.0, <=0.4.5) potentially affected by CVE-2026-54590 via asyncssh (1.10.1)

asyncssh PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.4.0, =0.4.5 Source cves: CVE-2026-54590 Source advisory: OSV:PYSEC-2026-3809...