PyPIPackage

asyncssh

7 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release: 2.24.1 (Oct 4, 2026): no advisory affects it
Newest unaffected release: 2.24.1 (Oct 4, 2026), the latest release
Advisories: 7 · 2 high, 4 medium

Weekly downloads: 3.6M
Dependents: 656
Releases: 93 since 0.8.1 (Aug 16, 2014)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-62949
Affects 0.8.1 to 2.23.1 (2.24.0 is outside it)
CVE-2026-45309
Affects 2.22.0 (2.23.0 is outside it)
CVE-2026-54590
Affects 0.8.1 to 2.23.0 (2.23.1 is outside it)
CVE-2026-54591
Affects 0.8.1 to 2.23.0 (2.23.1 is outside it)
CVE-2023-46446
Affects 0.8.1 to 2.14.0 (2.14.1 is outside it)
CVE-2023-46445
Affects 0.8.1 to 2.14.0 (2.14.1 is outside it)
CVE-2018-7749
Affects 0.8.1 to 1.12.0 (1.12.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2026-62949Medium 6.5
AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION
Affected: fixed in 2.24.0.
Fixed in 2.24.0 (released Jun 27, 2026, 81 days before disclosure).
The latest release, 2.24.1, is not affected.
CVE-2026-45309High 8.2
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
Affected: from 2.22.0, fixed in 2.23.0.
Fixed in 2.23.0 (released May 9, 2026, 69 days before disclosure).
The latest release, 2.24.1, is not affected.
CVE-2026-54590Medium 5.9
AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion
Affected: fixed in 2.23.1.
Fixed in 2.23.1 (released Jun 7, 2026, 31 days before disclosure).
The latest release, 2.24.1, is not affected.
CVE-2026-54591High 8.1
AsyncSSH: SCP Path Traversal to Arbitrary File Write
Affected: fixed in 2.23.1.
Fixed in 2.23.1 (released Jun 7, 2026, 31 days before disclosure).
The latest release, 2.24.1, is not affected.
CVE-2023-46446Medium 6.8
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and…
Affected: fixed in 2.14.1.
Fixed in 2.14.1 (released Nov 9, 2023, 5 days before disclosure).
The latest release, 2.24.1, is not affected.
CVE-2023-46445Medium 5.9
An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a…
Affected: fixed in 2.14.1.
Fixed in 2.14.1 (released Nov 9, 2023, 5 days before disclosure).
The latest release, 2.24.1, is not affected.
CVE-2018-7749Unrated
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing…
Affected: fixed in 1.12.1; fixed in 1.12.1.
Fixed in 1.12.1 (released Mar 10, 2018, 2 days before disclosure).
The latest release, 2.24.1, is not affected.