CVE-2026-62949

Summary

A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSH_MSG_CHANNEL_OPEN_CONFIRMATION (server→client) or SSH_MSG_CHANNEL_OPEN (client→server). AsyncSSH stores the peer-supplied value verbatim with no lower-bound check; the first time channel data is written, SSHChannel._flush_send_buf enters a synchronous infinite loop that cannot be interrupted by asyncio.wait_for or any timeout. The loop body has no await, so it blocks the entire asyncio event loop — for a server, one malicious authenticated channel freezes all current and future connections.

RFC 4254 §5.1 leaves receiver behavior for a peer-reported "maximum packet size = 0" undefined, so the value must be rejected rather than stored.

Root cause

asyncssh/channel.py:

# process_open (server side)        -- line 465
self._send_pktsize = send_pktsize    # peer value, no >= 1 check

# process_open_confirmation (client) -- line 528
self._send_pktsize = send_pktsize    # peer value, no >= 1 check

# _flush_send_buf                    -- lines 305-320
while self._send_buf and self._send_window:
    pktsize = min(self._send_window, self._send_pktsize)  # 0 when peer sends 0
    buf, datatype = self._send_buf[0]
    if len(buf) > pktsize:          # True for any buffered data
        data = buf[:pktsize]        # empty (b'')
        del buf[:pktsize]           # no-op
    ...
    self._send_window -= len(data)  # -= 0, unchanged

With _send_pktsize == 0, pktsize is 0, so buf[:0] is empty, del buf[:0] is a no-op, and _send_window is never decremented — the while condition is permanently true, and with no await in the body the event loop is blocked.

Impact

• Client vector (primary): a malicious SSH server replies to the client's channel open with maximum packet size = 0; the client wedges on its first channel write. The attacker is the server, so it needs no valid credentials.
• Server vector: an authenticated client opens a channel with maximum packet size = 0; any server-side channel write wedges the AsyncSSH server's event loop, freezing every current and future connection. A single low-privilege account can take the whole server down.

Both vectors are a single SSH message, deterministic, and cause total availability loss for the affected process.

Affected versions

<= 2.23.1 (latest release, 2026-06-06); also present on master (channel.py:465/528 unguarded). Verified end-to-end on 2.23.1.

Verification

The maintainer's proposed fix (reject send_pktsize == 0 in connection.py _process_channel_open / _process_channel_open_confirmation) was applied to 2.23.1 and re-tested end-to-end over TCP:

• Unpatched: malicious server (paramiko forcing max_packet_size=0 in OPEN_CONFIRMATION) + real asyncssh client → client event loop wedges.
• Patched: the guard fires inside _process_channel_open_confirmation, the malicious value is rejected, the connection closes cleanly (ChannelOpenError: SSH connection closed), and the client does not wedge.

The maintainer (Ron Frederick) independently confirmed the freeze and noted that even shutting the server down does not break clients out of the loop.

Reproducers available: a focused harness driving the real SSHChannel._flush_send_buf with _send_pktsize=0, and an end-to-end malicious_server.py (paramiko) + client.py (real asyncssh) pair. The end-to-end client repro uses asyncio.new_event_loop() (not get_event_loop()) for Python 3.14 compatibility.

Suggested fix (maintainer's approach)

In connection.py, after each send_pktsize = packet.get_uint32() in _process_channel_open and _process_channel_open_confirmation:

if send_pktsize == 0:
    raise ProtocolError('Invalid maximum packet size')

CVSS

…

Summary

A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSH_MSG_CHANNEL_OPEN_CONFIRMATION (server→client) or SSH_MSG_CHANNEL_OPEN (client→server). AsyncSSH stores the peer-supplied value verbatim with no lower-bound check; the first time channel data is written, SSHChannel._flush_send_buf enters a synchronous infinite loop that cannot be interrupted by asyncio.wait_for or any timeout. The loop body has no await, so it blocks the entire asyncio event loop — for a server, one malicious authenticated channel freezes all current and future connections.

RFC 4254 §5.1 leaves receiver behavior for a peer-reported "maximum packet size = 0" undefined, so the value must be rejected rather than stored.

Root cause

asyncssh/channel.py:

# process_open (server side)        -- line 465
self._send_pktsize = send_pktsize    # peer value, no >= 1 check

# process_open_confirmation (client) -- line 528
self._send_pktsize = send_pktsize    # peer value, no >= 1 check

# _flush_send_buf                    -- lines 305-320
while self._send_buf and self._send_window:
    pktsize = min(self._send_window, self._send_pktsize)  # 0 when peer sends 0
    buf, datatype = self._send_buf[0]
    if len(buf) > pktsize:          # True for any buffered data
        data = buf[:pktsize]        # empty (b'')
        del buf[:pktsize]           # no-op
    ...
    self._send_window -= len(data)  # -= 0, unchanged

With _send_pktsize == 0, pktsize is 0, so buf[:0] is empty, del buf[:0] is a no-op, and _send_window is never decremented — the while condition is permanently true, and with no await in the body the event loop is blocked.

Impact

• Client vector (primary): a malicious SSH server replies to the client's channel open with maximum packet size = 0; the client wedges on its first channel write. The attacker is the server, so it needs no valid credentials.
• Server vector: an authenticated client opens a channel with maximum packet size = 0; any server-side channel write wedges the AsyncSSH server's event loop, freezing every current and future connection. A single low-privilege account can take the whole server down.

Both vectors are a single SSH message, deterministic, and cause total availability loss for the affected process.

Affected versions

<= 2.23.1 (latest release, 2026-06-06); also present on master (channel.py:465/528 unguarded). Verified end-to-end on 2.23.1.

Verification

The maintainer's proposed fix (reject send_pktsize == 0 in connection.py _process_channel_open / _process_channel_open_confirmation) was applied to 2.23.1 and re-tested end-to-end over TCP:

• Unpatched: malicious server (paramiko forcing max_packet_size=0 in OPEN_CONFIRMATION) + real asyncssh client → client event loop wedges.
• Patched: the guard fires inside _process_channel_open_confirmation, the malicious value is rejected, the connection closes cleanly (ChannelOpenError: SSH connection closed), and the client does not wedge.

The maintainer (Ron Frederick) independently confirmed the freeze and noted that even shutting the server down does not break clients out of the loop.

Reproducers available: a focused harness driving the real SSHChannel._flush_send_buf with _send_pktsize=0, and an end-to-end malicious_server.py (paramiko) + client.py (real asyncssh) pair. The end-to-end client repro uses asyncio.new_event_loop() (not get_event_loop()) for Python 3.14 compatibility.

Suggested fix (maintainer's approach)

In connection.py, after each send_pktsize = packet.get_uint32() in _process_channel_open and _process_channel_open_confirmation:

if send_pktsize == 0:
    raise ProtocolError('Invalid maximum packet size')

CVSS

…

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.

These are all security issues fixed in the python313-asyncssh-2.24.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-asyncssh fixes the following issues:

Changes in python-asyncssh:

• CVE-2026-62949: denial of service via infinite loop when processing zero-sized SSH packets (bsc#1280972)