Vulnerabilities for asyncssh

First version without a known vulnerability: 2.24.0

Details

• GHSA-rw4j-r22c-9gc32026-09-17

  AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

  Fixed in: 2.24.0

• GHSA-2wxc-x7rj-hg8f2026-08-26

  asyncssh has SCP Path Traversal to Arbitrary File Write

  Fixed in: 2.23.1

• GHSA-qr67-gv47-xwwh2026-08-26

  asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

  Fixed in: 2.23.1

• GHSA-g794-3fmp-753h2026-05-27

  AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

  Fixed in: 2.23.0

• GHSA-hfmc-7525-mj552023-12-18

  AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC

  Fixed in: 2.14.2

• GHSA-c35q-ffpf-5qpm2023-11-09

  AsyncSSH Rogue Session Attack

  Fixed in: 2.14.1

• GHSA-cfc2-wr2v-gxm52023-11-09

  AsyncSSH Rogue Extension Negotiation

  Fixed in: 2.14.1

• GHSA-97cv-6pjf-5f9q2022-05-14

  AsyncSSH SSH Server Authentication Bypass

  Fixed in: 1.12.1, c161e26cdc0d41b745b63d9f17b437f073bf7ba4