# CVE-2026-62949: AsyncSSH event-loop infinite loop via zero maximum packet size

Source: https://junglewise.ai/threats/cve-2026-62949-asyncssh-event-loop-infinite-loop-via-zero-maximum-packet-size  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62949 · Severity: medium · CVSS 6.5 · Published 2026-09-16

AsyncSSH is a Python library for building SSH clients and servers. A malicious SSH server can freeze an AsyncSSH client, and any authenticated user can freeze an AsyncSSH server, by sending a channel maximum packet size of zero. This causes the event loop to enter an uninterruptible infinite loop, making the affected process completely unavailable—either until restart or until the connection is forcibly terminated at the network level. A single authenticated account can take down an entire server.

Technologies: [asyncssh (PyPI)](https://junglewise.ai/threats/technologies/pypi-asyncssh). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-62949 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62949 being exploited in the wild.

**How severe is CVE-2026-62949?** Medium severity, with a CVSS score of 6.5, published 16 September 2026.

**Which products and versions are affected?** asyncssh (PyPI) ECOSYSTEM:introduced=0,fixed=2.24.0.

**Is there a fix for CVE-2026-62949?** Yes. asyncssh (PyPI): upgrade to 2.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62949 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-62949?** Check whether you run asyncssh (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- asyncssh (PyPI): upgrade to 2.24.0 or later

  ```sh
  pip install "asyncssh>=2.24.0"
  ```


## Technical details

The vulnerability is a missing input validation flaw in AsyncSSH's channel implementation. When processing SSH_MSG_CHANNEL_OPEN_CONFIRMATION (server→client) or SSH_MSG_CHANNEL_OPEN (client→server), the code in `asyncssh/channel.py` stores the peer-supplied `send_pktsize` value without checking that it is at least 1. Later, when `SSHChannel._flush_send_buf` is called to write channel data, it enters a while loop that computes `pktsize = min(self._send_window, self._send_pktsize)`. If `_send_pktsize` is 0, then `pktsize` is 0, so `buf[:0]` extracts an empty slice, the delete operation is a no-op, and `_send_window` is never decremented. The while condition remains true indefinitely, and since the loop body contains no await statements, the entire asyncio event loop is blocked. For servers, this allows a single authenticated user to freeze all current and future connections. RFC 4254 §5.1 leaves the behavior for a peer-reported maximum packet size of 0 undefined, requiring rejection rather than storage. A fix has been proposed and verified: reject `send_pktsize == 0` with a ProtocolError in `connection.py` before storing the value.

## Affected products

- Ron Frederick AsyncSSH <= 2.23.1

## Identifiers

- CVE-2026-62949
- GHSA-rw4j-r22c-9gc3
- PYSEC-2026-4026

## Timeline

- 2026-06-20: disclosed: Reported by zhangph (afldl)
- 2026-09-17: advisory: GHSA-rw4j-r22c-9gc3 published
- 2026-09-17: patched: Fix available in version 2.24.0

## References

- [https://api.github.com/users/afldl](https://api.github.com/users/afldl)
- [https://github.com/afldl](https://github.com/afldl)
- [https://api.github.com/users/afldl/gists%7B/gist_id%7D](https://api.github.com/users/afldl/gists%7B/gist_id%7D)
- [https://api.github.com/users/afldl/repos](https://api.github.com/users/afldl/repos)
- [https://avatars.githubusercontent.com/u/220292072?v=4](https://avatars.githubusercontent.com/u/220292072?v=4)
- [https://api.github.com/users/afldl/events%7B/privacy%7D](https://api.github.com/users/afldl/events%7B/privacy%7D)

## Related threats

- [ronf AsyncSSH path traversal in AuthorizedKeysFile](https://junglewise.ai/threats/cve-2026-45309-ronf-asyncssh-path-traversal-in-authorizedkeysfile)
- [AsyncSSH path traversal in SCP client](https://junglewise.ai/threats/cve-2026-54591-asyncssh-path-traversal-in-scp-client)
- [ronf AsyncSSH path traversal in AuthorizedKeysFile username substitution](https://junglewise.ai/threats/cve-2026-54590-ronf-asyncssh-path-traversal-in-authorizedkeysfile-username)
- [AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC](https://junglewise.ai/threats/asyncssh-vulnerable-to-prefix-truncation-attack-a-k-a-terrapin-attack-70e933b5)
- [AsyncSSH Rogue Session Attack](https://junglewise.ai/threats/cve-2023-46446-asyncssh-rogue-session-attack)