SUSE SLED15 / SLES15 Security Update : python-anyio (SUSE-SU-2026:4416-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4416-1 advisory. - CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing...

Security update for python-anyio

This update for python-anyio fixes the following issues: CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475. Patch Instructions: To install...

SUSE-SU-2026:4416-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

PYSEC-2026-4024 AnyIO process-pool workers can block indefinitely on undrained stderr

Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code...

AnyIO process-pool workers can block indefinitely on undrained stderr

ImpactAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code th...

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

PYSEC-2026-4025 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

PYSEC-2026-4023 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

ImpactServices using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

CLEANSTART-2026-XX95180 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

Security vulnerability affects the py3-anyio package. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio...

PT-2026-105785

Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code...

PT-2026-105784

AnyIO 4.14.0 accepts the POSIX extra groups argument on anyio.run process and anyio.open process, but open process forwards the wrong variable to the backend: when extra groups is not None, it assigns kwargs"extra groups" = group instead of extra groups. As a result, callers cannot reliably clear...

PT-2026-105786

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connect tcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

CVE-2026-63374

A flaw was found in AnyIO. A remote attacker in a privileged network position can bypass Transport Layer Security TLS certificate validation when connecting to internationalized domain names. This vulnerability occurs because the framework converts internationalized hostnames using an outdated...

ROOT-APP-PYPI-CVE-2026-63374 CVE-2026-63374 in anyio - Patched by Root

Root has patched CVE-2026-63374 in the anyio package for Root:PyPI. Multiple fixed versions available...

CLEANSTART-2026-HN56879 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

CVE-2026-64847 affects multiple packages. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. See references for individual vulnerability details...

CLEANSTART-2026-YH72790 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

CVE-2026-63374 affects multiple packages. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. See references for individual vulnerability details...

CLEANSTART-2026-KA42623 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

Security vulnerability affects the airflow-3 package. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio...

ROOT-APP-PYPI-CVE-2026-63349 CVE-2026-63349 in anyio - Patched by Root

Root has patched CVE-2026-63349 in the anyio package for Root:PyPI. Multiple fixed versions available...

CLEANSTART-2026-YN00002 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

CVE-2026-63374 affects multiple packages. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. See references for individual vulnerability details...