https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 15:39:16 +0000 https://vulnerability.circl.lu/vuln/brew-dvc-cve-2026-62949 <p><strong>Affected:</strong> Homebrew: dvc</p> <p>## Summary</p> <p>A malicious SSH server can wedge an AsyncSSH **client**, and an authenticated client can wedge an AsyncSSH **server**, by sending a channel `maximum packet size` of `0` in `SSH_MSG_CHANNEL_OPEN_CONFIRMATION` (server→client) or `SSH_MSG_CHANNEL_OPEN` (client→server). AsyncSSH stores the peer-supplied value verbatim with no lower-bound check; the first time channel data is written, `SSHChannel._flush_send_buf` enters a **synchronous infinite loop** that cannot be interrupted by `asyncio.wait_for` or any timeout. The loop body has no `await`, so it blocks the entire asyncio event loop — for a server, one malicious authenticated channel freezes **all** current and future connections.</p> <p>RFC 4254 §5.1 leaves receiver behavior for a peer-reported &#34;maximum packet size = 0&#34; undefined, so the value must be rejected rather than stored.</p> <p>## Root cause</p> <p>`asyncssh/channel.py`:</p> <p>```python # process_open (server side) -- line 465 self._send_pktsize = send_pktsize # peer value, no &gt;= 1 check</p> <p># process_open_confirmation (client) -- line 528 self._send_pktsize = send_pktsize # peer value, no &gt;= 1 check</p> <p># _flush_send_buf -- lines 305-320 while self._send_buf and self._send_window: pktsize = min(self._send_window, self._send_pktsize) # 0 when peer sends 0 buf, datatype = self._send_buf[0] if len(buf) &gt; pktsize: # True for any buffered data data = buf[:pktsize] # empty (b&#39;&#39;) del buf[:pktsize] # no-…</p> <p><strong>Affected:</strong> Homebrew: dvc</p> <p>## Summary</p> <p>A malicious SSH server can wedge an AsyncSSH **client**, and an authenticated client can wedge an AsyncSSH **server**, by sending a channel `maximum packet size` of `0` in `SSH_MSG_CHANNEL_OPEN_CONFIRMATION` (server→client) or `SSH_MSG_CHANNEL_OPEN` (client→server). AsyncSSH stores the peer-supplied value verbatim with no lower-bound check; the first time channel data is written, `SSHChannel._flush_send_buf` enters a **synchronous infinite loop** that cannot be interrupted by `asyncio.wait_for` or any timeout. The loop body has no `await`, so it blocks the entire asyncio event loop — for a server, one malicious authenticated channel freezes **all** current and future connections.</p> <p>RFC 4254 §5.1 leaves receiver behavior for a peer-reported &#34;maximum packet size = 0&#34; undefined, so the value must be rejected rather than stored.</p> <p>## Root cause</p> <p>`asyncssh/channel.py`:</p> <p>```python # process_open (server side) -- line 465 self._send_pktsize = send_pktsize # peer value, no &gt;= 1 check</p> <p># process_open_confirmation (client) -- line 528 self._send_pktsize = send_pktsize # peer value, no &gt;= 1 check</p> <p># _flush_send_buf -- lines 305-320 while self._send_buf and self._send_window: pktsize = min(self._send_window, self._send_pktsize) # 0 when peer sends 0 buf, datatype = self._send_buf[0] if len(buf) &gt; pktsize: # True for any buffered data data = buf[:pktsize] # empty (b&#39;&#39;) del buf[:pktsize] # no-…</p> https://vulnerability.circl.lu/vuln/brew-dvc-cve-2026-62949 https://vulnerability.circl.lu/vuln/cve-2026-62949 <p><strong>Affected:</strong> ronf asyncssh</p> <p>AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.</p> <p><strong>Affected:</strong> ronf asyncssh</p> <p>AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-62949