Hi,

The following vulnerability was published for python-asyncssh.

CVE-2026-62949[0]:
| AsyncSSH is a Python package which provides an asynchronous client
| and server implementation of the SSHv2 protocol on top of the Python
| asyncio framework. Prior to 2.24.0, _process_channel_open and
| _process_channel_open_confirmation in asyncssh/connection.py accept
| a peer-supplied send_pktsize value of zero. When channel data
| reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero
| value causes each loop iteration to slice and remove zero bytes
| without reducing the send window, leaving the synchronous loop
| permanently true with no await point. A malicious SSH server can
| trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION
| before the first channel write, while an authenticated client can
| trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze
| every current and future connection handled by the process. This
| vulnerability is fixed in 2.24.0.

Note while th base of the fix [2] is in 2.24.0 indeend, there is a
required followup [3]. Thus we are for security-tracker this CVE not
yet considering as fixed with 2.24.0-1 but rather only when the
followup commit is applied as we...


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-62949
https://www.cve.org/CVERecord?id=CVE-2026-62949
[1] https://github.com/ronf/asyncssh/security/advisories/GHSA-rw4j-r22c-9gc3
[2] https://github.com/ronf/asyncssh/commit/9c354270c009285525e126721e8ed5fbed1f8a67
[3] https://github.com/ronf/asyncssh/commit/756cbae5350789ce9735f15f704bae9b5a3608b8

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore