CVE-2026-62949: AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSH_MSG_CHANNEL_OPEN_CONFIRMATION (server→client) or SSH_MSG_CHANNEL_OPEN (client→server). AsyncSSH stores the peer-supplied value verbatim with no lower-bound check; the first time channel data is written, SSHChannel._flush_send_buf enters a synchronous infinite loop that cannot be interrupted by asyncio.wait_for or any timeout. The loop body has no await, so it blocks the entire asyncio event loop — for a server, one malicious authenticated channel freezes all current and future connections.

RFC 4254 §5.1 leaves receiver behavior for a peer-reported “maximum packet size = 0” undefined, so the value must be rejected rather than stored.