Asyncssh

This hub aggregates every CVE we track for Asyncssh, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 9 most recently published vulnerabilities affecting Asyncssh.

• CVE-2026-62949AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION6.5Sep 16, 2026
• CVE-2026-45309AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username7.5Jul 17, 2026
• CVE-2026-54590AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion5.9Jul 8, 2026
• CVE-2026-54591AsyncSSH: SCP Path Traversal to Arbitrary File Write8.1Jul 8, 2026
• GHSA-hfmc-7525-mj55AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MACDec 18, 2023
• CVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (fr...5.9Dec 18, 2023
• CVE-2023-46445An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."5.9Nov 14, 2023
• CVE-2023-46446An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."6.8Nov 14, 2023
• CVE-2018-7749The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the aut...9.8Mar 12, 2018