Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in AnyIO (CVE-2026-63349, CVE-2026-63374)

Summary Multiple vulnerabilities in the AnyIO asynchronous concurrency library CVE-2026-63349, CVE-2026-63374 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 4.14.2. Vulnerability Details CVEID:CVE-2026-63349 DESCRIPTION: AnyIO is a high level...

Security update for python-anyio (important)

openSUSE security update: security update for python-anyio ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22060-1 Rating: important References: bsc1281475 bsc1281476 Cross-References: CVE-2026-63374 CVE-2026-64847 CVSS scores: CVE-2026-63374 SUSE :...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 15 Vulnerability Details CVEID:CVE-2026-64847 DESCRIPTION: AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO...

OPENSUSE-SU-2026:22060-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

SUSE-SU-2026:24208-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

SUSE-SU-2026:24122-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

SUSE SLED15 / SLES15 Security Update : python-anyio (SUSE-SU-2026:4416-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4416-1 advisory. - CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing...

Security update for python-anyio

This update for python-anyio fixes the following issues: CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475. Patch Instructions: To install...

SUSE-SU-2026:4416-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

AnyIO process-pool workers can block indefinitely on undrained stderr

ImpactAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code th...

PYSEC-2026-4023 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

aindy-runtime (>=1.5.0, <=1.11.0), amarcord (>=1.5.0, <=1.5.2) +23 more potentially affected by CVE-2026-63349 via anyio (>=4.14.0, <=4.14.1)

anyio PYPI version =4.14.0, =1.5.0, =1.5.0, =0.0.3, =1.8.0, =0.10.2, =0.1.4, =2.19.0, =1.3.1, =0.1.1, =0.1.0, =0.0.1a1, =1.0.0a1, =0.0.1a1, =1.0.0 and more Source cves: CVE-2026-63349 Source advisory: OSV:PYSEC-2026-4023...

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

ImpactServices using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

agl-ocr-reader (1.1.1), app-ocr (>=0.0.1, <=1.2.14) +7 more potentially affected by CVE-2026-64847 via anyio (3.7.0)

anyio PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - agl-ocr-reader 1.1.1 - app-ocr =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.2.0 - yt-fts 0.1.6 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

aac (>=0.1.10, <=0.5.21), aac-bom (>=0.0.1, <=0.0.4) +71 more potentially affected by CVE-2026-64847 via anyio (3.6.2)

anyio PYPI version 3.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aac =0.1.10, =0.0.1, =0.1.0, =0.1.3, =0.0.1, =0.1.5, =0.1.1, =0.0.3, =0.1.1, =0.4.2, =0.0.1, =0.1.0, =0.3.0 and more Source cves: CVE-2026-64847 Sourc...

5mghost-rover (>=0.0.1, <=0.0.3), aaaai (>=0.1.3, <=0.3.0) +853 more potentially affected by CVE-2026-64847 via anyio (>=4.0.0rc1, <=4.14.1)

anyio PYPI version =4.0.0rc1, =0.0.1, =0.1.3, =0.6.0, =0.0.32, =0.0.1, =4.8.2, =0.1.3, =0.1.0, =0.4.0, =0.1.1, =0.1.0, =0.1.31, =0.1.0, =0.0.2, =0.4.0rc1, =0.7.1 and more Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

machine-web (>=0.0.1, <=0.0.2.post2) potentially affected by CVE-2026-64847 via anyio (3.3.2)

anyio PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - machine-web =0.0.1, =0.0.2.post2 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-64847 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

image-crawl (0.1.0), opentrons (>=4.6.0a0, <=7.1.1a0) +4 more potentially affected by CVE-2026-64847 via anyio (3.3.0)

anyio PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - image-crawl 0.1.0 - opentrons =4.6.0a0, =0.3.0, =0.1.0, =1.0.0, =1.2.0 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...