Two AsyncSSH Vulnerabilities Detected in One Python Security Scan: CVE-2026-54591 and CVE-2026-62949

One Python package can contain multiple known security issues. The minimum version fixing each advisory can differ from the minimum version addressing all of those advisories. On November 5, 2026, we tested this distinction in a live LegacyFixer scan.

Two vulnerabilities, two patched-version boundaries

AsyncSSH provides asynchronous SSH client and server functionality in Python. Our test targeted asyncssh==2.23.0, a version affected by two distinct 2026 vulnerabilities:

CVE-2026-54591: SCP file path traversal

The AsyncSSH maintainer advisory describes how a malicious SCP server can provide filenames containing directory-traversal sequences during downloads. In affected clients, resulting writes may escape the intended destination directory. The first patched version for this issue is 2.23.1. Applications that do not use the affected SCP transfer path do not automatically have the same exposure.

CVE-2026-62949: event-loop denial of service

The separate AsyncSSH advisory documents handling of an SSH channel's declared maximum packet size of zero. Under the affected conditions, writing channel data can cause an infinite loop which blocks the asyncio event loop. The fix first appears in 2.24.0.

These are distinct vulnerabilities, not duplicate identifiers for one flaw. The CVE mappings are established from upstream advisories; the LegacyFixer report showed PYSEC identifiers, not CVE numbers. Any upstream severity ratings should not be mistaken for scores calculated by LegacyFixer.

A controlled GitHub repository scan

We created a private repository, Dom-33/legacyfixer-asyncssh-cve-test, with the following pinned requirement:

asyncssh==2.23.0

We authorized the repository in the LegacyFixer GitHub App, connected it to the dashboard, and ran a production scan with optional fix PRs disabled. The scan was real; no exploit payload was executed.

Scan #232 — observed production result

The report recorded PYSEC-2026-3808 with fix version 2.23.1, and PYSEC-2026-4026 with fix version 2.24.0, both for asyncssh==2.23.0. The engine completed without a pull request. NO_ACTION does not mean no vulnerabilities were detected; here, it means no remediation action was taken.

Why LegacyFixer reported two different fix versions

Each advisory specifies its own earliest fixed release. Version 2.23.1 fixes the SCP flaw but does not address the later-fixed event-loop flaw. To address both findings in this test, the earliest appropriate fixed release is 2.24.0.

An illustrative update to the pinned requirement is:

asyncssh==2.24.0

This is not a patch performed or verified by scan #232. Users remain responsible for choosing a suitable fixed release, checking compatibility, and re-running an audit after upgrading. A later supported release may also be appropriate.

What the experiment establishes

The live scan confirms that LegacyFixer detected both published advisory records in the specified dependency, preserved their different reported fix versions, and completed without modifying the repository or opening a PR. The independent upstream advisory records confirm that the two findings refer to different CVEs.

The scan does not demonstrate exploitability in any deployed application, successful exploitation of either issue, or compatibility of an upgraded dependency. Dependency detection and application exposure analysis are different tasks.

Sources and verification

• AsyncSSH maintainer advisory — CVE-2026-54591
• AsyncSSH maintainer advisory — CVE-2026-62949
• PyPA/OSV advisory PYSEC-2026-3808
• PyPA/OSV advisory PYSEC-2026-4026
• AsyncSSH upstream changelog

Verification date: November 5, 2026. Recheck upstream advisory data before production upgrades.