Security update for python-anyio

This update for python-anyio fixes the following issues: CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475. Patch Instructions: To install...

AnyIO process-pool workers can block indefinitely on undrained stderr

ImpactAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code th...

PYSEC-2026-4024 AnyIO process-pool workers can block indefinitely on undrained stderr

Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code...

CVE-2025-71425

Contrast Edgeless Systems before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are...

CVE-2025-71425 Contrast before 1.8.1 Information Disclosure via Logging

Contrast Edgeless Systems before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are...

CVE-2025-71425

The Contrast product (Edgeless Systems) before version 1.8.1 is vulnerable to Information Disclosure via logging. When the CONTRAST_LOG_LEVEL is set to info (the default) or debug, the Contrast initializer logs the workload secret to stderr. This exposes secrets to Kubernetes users with get or li...

EUVD-2025-211007

Contrast Edgeless Systems before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are...

CVE-2025-71425 Contrast before 1.8.1 Information Disclosure via Logging

Contrast Edgeless Systems before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are...

CVE-2025-71425: Insertion of Sensitive Information into Log File

Contrast Edgeless Systems before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRASTLOGLEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are...

CVE-2026-64847

A flaw was found in AnyIO. Untrusted or faulty worker code can write a large amount of data to the standard error stderr stream. This data fills a pipe that the parent process fails to drain, causing the process-pool call to block indefinitely. This can lead to a Denial of Service DoS condition,...

Linux Distros Unpatched Vulnerability : CVE-2026-64847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool...

DEBIAN-CVE-2026-64847

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

CVE-2026-64847

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

UBUNTU-CVE-2026-64847

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

CVE-2026-64847

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

Allocation of Resources Without Limits or Throttling

Overview anyio is a High level compatibility layer for multiple asynchronous event loop implementations Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in processworker within src/anyio/toprocess.py, where stderr in a worker subprocess is...

GHSA-5P39-CFHJ-2XMP AnyIO process-pool workers can block indefinitely on undrained stderr

Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code...

AnyIO process-pool workers can block indefinitely on undrained stderr

Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code...

CVE-2026-64847

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

EUVD-2026-83193

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...