CVE-2018-7749: Asyncssh Project Asyncssh

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.

Affected products

• Asyncssh Project Asyncssh: before 1.12.1 (fixed in 1.12.1)

Published 2018-03-12. Last modified 2026-06-17.