New release for CVE-2026-62949 fix

[markparonyan]

Hi, our project depends on this library and we need an update with CVE-2026-62949 fix
https://www.mend.io/vulnerability-database/CVE-2026-62949/

What stops the release? Is there anything we can help with?

[markparonyan]

@ronf check please

[ronf]

CVE-2026-62949 was published back in July and the fix for it is already present in the AsyncSSH 2.24.0 release. Since then, there has been another related issue found, but that security vulnerability report shouldn't be published yet. Somehow the mend.io database entry seems to include details from the unpublished advisory, which is concerning.

The new issue is specific to interoperating with dropbear, or something pretending to be dropbear. A fix for that went into commit aee6203 just a day or two ago (on Saturday) and I have requested a new CVE to be assigned for this, but it may take some time for that to happen. I do expect to create a new release which will include this fix and several others, but new reports are coming in fast enough that I have been holding back until there's a bit of a lull so I can make sure everything in the reports have been addressed, particularly for reports like this which are follow-ons to an incomplete fix in a previous release.

[markparonyan]

Somehow the mend.io database entry seems to include details from the unpublished advisory, which is concerning.

it is indeed...

Thank you for your work, we will wait for the release.