CRITICAL9.8PyPI
PYSEC-2018-108· CVE-2018-7749, GHSA-97cv-6pjf-5f9qModified: 6/10/2026
package
PyPI/asyncssh
pkg:pypi/asyncssh
MEDIUM5.9PyPI
PYSEC-2023-237· CVE-2023-46445, GHSA-cfc2-wr2v-gxm5Modified: 11/17/2023
MEDIUM6.8PyPI
PYSEC-2023-239· CVE-2023-46446, GHSA-c35q-ffpf-5qpmModified: 11/20/2023
MEDIUM6.9PyPI
PYSEC-2026-2384· CVE-2026-45309, GHSA-g794-3fmp-753hAsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-3808· CVE-2026-54591, GHSA-2wxc-x7rj-hg8fasyncssh has SCP Path Traversal to Arbitrary File Write
Modified: 9/10/2026
MEDIUM5.9PyPI
PYSEC-2026-3809· CVE-2026-54590, GHSA-qr67-gv47-xwwhasyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Modified: 9/10/2026
MEDIUM6.5PyPI
PYSEC-2026-4026· CVE-2026-62949, GHSA-rw4j-r22c-9gc3AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION
Modified: 10/1/2026
HIGH8.1PyPI
GHSA-2wxc-x7rj-hg8f· CVE-2026-54591, PYSEC-2026-3808asyncssh has SCP Path Traversal to Arbitrary File Write
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-97cv-6pjf-5f9q· CVE-2018-7749, PYSEC-2018-108AsyncSSH SSH Server Authentication Bypass
Modified: 2/16/2025
HIGH8.1PyPI
GHSA-c35q-ffpf-5qpm· CVE-2023-46446, PYSEC-2023-239AsyncSSH Rogue Session Attack
Modified: 7/8/2026
MEDIUM5.3PyPI
GHSA-cfc2-wr2v-gxm5· CVE-2023-46445, PYSEC-2023-237AsyncSSH Rogue Extension Negotiation
Modified: 7/8/2026
MEDIUM6.9PyPI
GHSA-g794-3fmp-753h· CVE-2026-45309, PYSEC-2026-2384AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
Modified: 9/10/2026
MEDIUM5.9PyPI
GHSA-hfmc-7525-mj55AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC
Modified: 12/7/2024
MEDIUM5.9PyPI
GHSA-qr67-gv47-xwwh· CVE-2026-54590, PYSEC-2026-3809asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-rw4j-r22c-9gc3· CVE-2026-62949, PYSEC-2026-4026AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION
Modified: 10/1/2026