ronf/asyncssh Security Advisories | GitStock

medium2026-09-17

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

GHSA-rw4j-r22c-9gc3 · CVE-2026-62949

high2026-08-26

asyncssh has SCP Path Traversal to Arbitrary File Write

GHSA-2wxc-x7rj-hg8f · CVE-2026-54591

medium2026-08-26

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

GHSA-qr67-gv47-xwwh · CVE-2026-54590

medium2026-05-27

AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

GHSA-g794-3fmp-753h · CVE-2026-45309

medium2023-12-18

AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC

GHSA-hfmc-7525-mj55

high2023-11-09

AsyncSSH Rogue Session Attack

GHSA-c35q-ffpf-5qpm · CVE-2023-46446

medium2023-11-09

AsyncSSH Rogue Extension Negotiation

GHSA-cfc2-wr2v-gxm5 · CVE-2023-46445

critical2022-05-14

AsyncSSH SSH Server Authentication Bypass

GHSA-97cv-6pjf-5f9q · CVE-2018-7749