PyPI/asyncssh CVE-2026-62949: medium 6.5, EPSS 0.39%

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Action: Upgrade asyncssh to 2.24.0 or later.

pip install asyncssh==2.24.0

Affected

Fixed versions

Sources

• osv: GHSA-rw4j-r22c-9gc3
• https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3
• https://nvd.nist.gov/vuln/detail/CVE-2026-62949
• https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8
• https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67
• https://github.com/ronf/asyncssh
• https://github.com/ronf/asyncssh/releases/tag/v2.24.0

CVE-2026-62949 · published 2026-09-17T14:53:01Z · modified 2026-10-01T17:55:57.395536709Z · JSON