CVE-2026-62949

Zero send_pktsize leads to infinite loop, freezing asyncssh connections.

• CVSS 6.5
• 835
• Input Validation and Sanitization
• Remote

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.

CVE

CVE-2026-62949

CWE

835

CVSS base score

6.5

Published

2026-09-16

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

AsyncSSH

Fixed by upgrading

Yes

Solution

Upgrade AsyncSSH to version 2.24.0 or later.

import asyncio
import asyncssh

class SSHChannel:
    def __init__(self, send_pktsize):
        self.send_pktsize = send_pktsize
        self._send_buffer = b''
        self._window = 1024

    def write(self, data: bytes):
        self._send_buffer += data
        self._flush_send_buf()

    def _flush_send_buf(self):
        # Loop until buffer empty or window exhausted.
        while self._send_buffer and self._window:
            # VULNERABLE: accept zero send_pktsize from peer
            chunk = self._send_buffer[:self.send_pktsize]
            self._window -= len(chunk)
            self._send_buffer = self._send_buffer[len(chunk):]

class Connection:
    def _process_channel_open(self, pkt: dict):
        # Peer‑supplied send_pktsize; zero is accepted.
        send_pktsize = pkt.get('send_pktsize', 32768)
        channel = SSHChannel(send_pktsize)
        # Store channel reference (omitted).

    def _process_channel_open_confirmation(self, pkt: dict):
        # Peer‑supplied send_pktsize; zero is accepted.
        send_pktsize = pkt.get('send_pktsize', 32768)
        channel = SSHChannel(send_pktsize)
        # Further handling (omitted).

import asyncio
import asyncssh

class SSHChannel:
    def __init__(self, send_pktsize):
        self.send_pktsize = send_pktsize
        self._send_buffer = b''
        self._window = 1024

    def write(self, data: bytes):
        self._send_buffer += data
        self._flush_send_buf()

    def _flush_send_buf(self):
        # Loop until buffer empty or window exhausted.
        while self._send_buffer and self._window:
            # FIX: enforce minimum send_pktsize of 1 byte
            chunk = self._send_buffer[:max(1, self.send_pktsize)]
            self._window -= len(chunk)
            self._send_buffer = self._send_buffer[len(chunk):]

class Connection:
    def _process_channel_open(self, pkt: dict):
        # Peer‑supplied send_pktsize; zero is rejected.
        send_pktsize = pkt.get('send_pktsize', 32768)
        if send_pktsize <= 0:
            send_pktsize = 1
        channel = SSHChannel(send_pktsize)
        # Store channel reference (omitted).

    def _process_channel_open_confirmation(self, pkt: dict):
        # Peer‑supplied send_pktsize; zero is rejected.
        send_pktsize = pkt.get('send_pktsize', 32768)
        if send_pktsize <= 0:
            send_pktsize = 1
        channel = SSHChannel(send_pktsize)
        # Further handling (omitted).

@misc{vaitp:cve202662949,
  title        = {{Zero send_pktsize leads to infinite loop, freezing asyncssh connections.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-62949},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-62949/}}
}