AsyncSSH v2.14.1 and earlier are affected by a novel prefix truncation attack (Terrapin attack) against the ChaCha20-Poly1305 and Encrypt-then-MAC SSH algorithms. The attack enables a man-in-the-middle to remove an arbitrary number of messages immediately after the initial key exchange, disrupting SSH extension negotiation (RFC8308) and downgrading security. It exploits the unauthenticated SSH_MSG_IGNORE messages and the delayed sequence number verification in SSH. ChaCha20-Poly1305 is fully vulnerable due to its stateless design, while Encrypt-then-MAC requires CBC cipher usage for practical exploitation. The attack can also enable exploitation of other implementation flaws in a MITM scenario. OpenSSH proposed a 'strict kex' handshake modification to mitigate this, which AsyncSSH has implemented in patched versions. Both client and server must support this fix. Temporarily disabling affected algorithms and using AES-GCM is advised until patches are deployed.

The vulnerability allows a man-in-the-middle attacker to strip messages after the SSH key exchange, causing a downgrade of SSH extension negotiation and connection security. This can disable security countermeasures and potentially expose the connection to further attacks. The attack does not compromise confidentiality directly but impacts integrity and security negotiation, leading to weakened security guarantees. ChaCha20-Poly1305 connections are fully vulnerable, while Encrypt-then-MAC is vulnerable when CBC ciphers are used. The attack can facilitate exploitation of other implementation flaws in MITM scenarios.

A patch is available that adds support for a 'strict kex' handshake to prevent the prefix truncation attack. Both client and server must support this countermeasure for it to be effective. As a temporary measure, disabling the affected algorithms (ChaCha20-Poly1305 and Encrypt-then-MAC with CBC ciphers) and using unaffected alternatives like AES-GCM is recommended until patches are applied.