StackRadar

CVE-2026-62949

Medium

Advisory

Published 17 Sept 2026In the index since 18 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
28
of 17,805 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Carried by container images the latest versions of 28 of 17,805 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
asyncsshpypi2.7.0, 2.10.1, 2.13.2, 2.14.0+7 more2.24.024
OSV records
GHSA-rw4j-r22c-9gc3

Charts affected

28 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
asyncssh@2.14.2
2.24.0

Open the chart page →

11,463
rook-cephrookOfficialVerified publisher1.20.71 of 2See more

rook-ceph rook 1.20.7

1 of the 2 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
rook/ceph:v1.20.72f970c425617
asyncssh@2.13.2
2.24.0

Open the chart page →

1,472
home-assistanthelm-hassVerified publisher0.3.821 of 1See more

home-assistant helm-hass 0.3.82

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
asyncssh@2.21.0
2.24.0

Open the chart page →

2,161
ceph-csi-cephfsceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-cephfs ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
asyncssh@2.13.2
2.24.0

Open the chart page →

4,143
ceph-csi-rbdceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-rbd ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
asyncssh@2.13.2
2.24.0

Open the chart page →

4,143
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
asyncssh@2.10.1
2.24.0

Open the chart page →

7,785
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
asyncssh@2.14.2
2.24.0

Open the chart page →

6,110
home-assistantalekcVerified publisher2.11.31 of 1See more

home-assistant alekc 2.11.3

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
asyncssh@2.21.0
2.24.0

Open the chart page →

2,161
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
asyncssh@2.21.0
2.24.0

Open the chart page →

2,161
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
asyncssh@2.21.0
2.24.0

Open the chart page →

2,360
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
asyncssh@2.21.0
2.24.0

Open the chart page →

4,694
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
asyncssh@2.23.1
2.24.0

Open the chart page →

5,470
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
asyncssh@2.21.0
2.24.0

Open the chart page →

2,161
home-assistantloeken-at-homeVerified publisher2026.5.11 of 1See more

home-assistant loeken-at-home 2026.5.1

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.5.14ce6abc553b3
asyncssh@2.21.0
2.24.0

Open the chart page →

3,071
home-assistantpree-helm-chartsVerified publisher1.81.01 of 1See more

home-assistant pree-helm-charts 1.81.0

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
asyncssh@2.21.0
2.24.0

Open the chart page →

2,161
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
asyncssh@2.14.1
2.24.0

Open the chart page →

6,248
rook-cephdtrdnk-helm-chartsVerified publisher0.0.11 of 2See more

rook-ceph dtrdnk-helm-charts 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
rook/ceph:v1.19.2944a1dd70496
asyncssh@2.13.2
2.24.0

Open the chart page →

2,015
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
asyncssh@2.21.0
2.24.0

Open the chart page →

2,201
extended-ceph-exporterextended-ceph-exporterVerified publisher1.10.01 of 2See more

extended-ceph-exporter extended-ceph-exporter 1.10.0

1 of the 2 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
quay.io/ceph/ceph:v21.1.05ff3692d2f3f
asyncssh@2.17.0
2.24.0

Open the chart page →

3,018
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
asyncssh@2.20.0
2.24.0

Open the chart page →

4,859
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
asyncssh@2.14.1
2.24.0

Open the chart page →

25,500
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
asyncssh@2.14.0
2.24.0

Open the chart page →

6,516
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
asyncssh@2.21.0
2.24.0

Open the chart page →

2,487
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
asyncssh@2.21.0
2.24.0

Open the chart page →

4,877
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
asyncssh@2.17.0
2.24.0

Open the chart page →

21,399
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
asyncssh@2.23.0
2.24.0

Open the chart page →

3,468
ceph-csi-cephfswikimedia0.1.81 of 5See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
asyncssh@2.7.0
2.24.0

Open the chart page →

10,334
ceph-csi-rbdwikimedia0.1.131 of 6See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2026-62949.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
asyncssh@2.7.0
2.24.0

Open the chart page →

11,840

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
asyncssh@2.21.0
2.24.0
3
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
asyncssh@2.13.2
2.24.0
2
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
asyncssh@2.7.0
2.24.0
2
aibrix/metadata-service:v0.7.063fb81a64377
asyncssh@2.23.1
2.24.0
1
apache/airflow:2.8.4-python3.964e58748b6b9
asyncssh@2.14.2
2.24.0
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
asyncssh@2.17.0
2.24.0
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
asyncssh@2.14.0
2.24.0
1
homeassistant/home-assistant:2026.75a531753cea9
asyncssh@2.21.0
2.24.0
1
homeassistant/home-assistant:2023.12.48d000332b09b
asyncssh@2.14.2
2.24.0
1
loeken/home-assistant:2026.5.14ce6abc553b3
asyncssh@2.21.0
2.24.0
1
openbas/caldera-server:5.1.0a277796d9724
asyncssh@2.14.1
2.24.0
1
rommapp/romm:5.2.03512f2ca4557
asyncssh@2.23.0
2.24.0
1
rook/ceph:v1.20.72f970c425617
asyncssh@2.13.2
2.24.0
1
rook/ceph:v1.19.2944a1dd70496
asyncssh@2.13.2
2.24.0
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
asyncssh@2.20.0
2.24.0
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
asyncssh@2.21.0
2.24.0
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
asyncssh@2.21.0
2.24.0
1
ghcr.io/home-assistant/home-assistant:2026.9.1:latest612d76760b54
asyncssh@2.21.0
2.24.0
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
asyncssh@2.21.0
2.24.0
1
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
asyncssh@2.21.0
2.24.0
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
asyncssh@2.10.1
2.24.0
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
asyncssh@2.14.1
2.24.0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
asyncssh@2.21.0
2.24.0
1
quay.io/ceph/ceph:v21.1.05ff3692d2f3f
asyncssh@2.17.0
2.24.0
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.