CVE-2026-63374 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connecttcp and TLSStream.wrap can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a...

CVE-2026-63374 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connecttcp and TLSStream.wrap can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a...

CVE-2026-63374

AnyIO (a Python asynchronous networking framework) is vulnerable to TLS certificate spoofing prior to version 4.14.2 . The functions connect_tcp() and TLSStream.wrap() validate internationalized (non-ASCII) domain names using the Python standard library's IDNA 2003 encoding instead of the more ac...

CVE-2026-63374 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connecttcp and TLSStream.wrap can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a...

EUVD-2026-84522

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connecttcp and TLSStream.wrap can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a...

CVE-2026-63374: Improper Certificate Validation

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connecttcp and TLSStream.wrap can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a...

SUSE CVE-2026-63374

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connecttcp and TLSStream.wrap can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

Linux Distros Unpatched Vulnerability : CVE-2026-63374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connecttcp and...

GHSA-82R6-8W77-94W6 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

Improper Validation of Certificate with Host Mismatch

Overview anyio is a High level compatibility layer for multiple asynchronous event loop implementations Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via TLSStream.wrap in src/anyio/streams/tls.py, which resolves international domain nam...

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

PT-2026-95726

Name of the Vulnerable Software and Affected Versions anyio versions prior to 4.14.2 Description Services using internationalized non-ASCII domain names are susceptible to a TLS certificate validation bypass. When using the connect tcp function or TLSStream.wrap, the software mishandles the...

EulerOS Virtualization 2.12.1 : python-idna (EulerOS-SA-2026-3610)

According to the versions of the python-idna package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in...

EulerOS Virtualization 2.12.0 : python-idna (EulerOS-SA-2026-3664)

According to the versions of the python-idna package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in...

EulerOS Virtualization 2.11.1 : python-idna (EulerOS-SA-2026-3459)

According to the versions of the python-idna package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in...

EulerOS Virtualization 2.11.0 : python-idna (EulerOS-SA-2026-3546)

According to the versions of the python-idna package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-45409)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Nam...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

EulerOS 2.0 SP15 : python-idna (EulerOS-SA-2026-3816)

According to the versions of the python-idna package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and...