Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 15 Vulnerability Details CVEID:CVE-2026-64847 DESCRIPTION: AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO...

SUSE-SU-2026:24122-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

SUSE SLED15 / SLES15 Security Update : python-anyio (SUSE-SU-2026:4416-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4416-1 advisory. - CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing...

Security update for python-anyio

This update for python-anyio fixes the following issues: CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475. Patch Instructions: To install...

SUSE-SU-2026:4416-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

image-crawl (0.1.0), opentrons (>=4.6.0a0, <=7.1.1a0) +4 more potentially affected by CVE-2026-64847 via anyio (3.3.0)

anyio PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - image-crawl 0.1.0 - opentrons =4.6.0a0, =0.3.0, =0.1.0, =1.0.0, =1.2.0 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

AnyIO process-pool workers can block indefinitely on undrained stderr

ImpactAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code th...

aiopath (>=0.5.8, <=0.6.8) potentially affected by CVE-2026-64847 via anyio (3.2.0)

anyio PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiopath =0.5.8, =0.6.8 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

antistasi-logbook (>=0.3.2, <=0.4.2), anubis-policy-api (>=0.3.0, <=0.6.0) +9 more potentially affected by CVE-2026-64847 via anyio (3.5.0)

anyio PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - antistasi-logbook =0.3.2, =0.3.0, =1.0.0, =0.2.4, =0.1.7, =1.0.20.post9, =0.1.0, =0.18.2, =0.14.0, =0.15.0 - xircuits 1.3.0 Source cves: CVE-2026-6484...

machine-web (>=0.0.1, <=0.0.2.post2) potentially affected by CVE-2026-64847 via anyio (3.3.2)

anyio PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - machine-web =0.0.1, =0.0.2.post2 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

aiojarm (>=0.2.0, <=0.2.1), aiometer (>=0.1.0, <=0.2.1) +11 more potentially affected by CVE-2026-64847 via anyio (1.4.0)

anyio PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiojarm =0.2.0, =0.1.0, =0.2.0, =0.2.0rc1, =0.1.3, =0.0.15, =0.0.2, =0.1.3, =0.4.1, =0.6.1 - roboto-telegram 0.3.0 - runnel 0.1.0a1 - sitemaps 0.1.0...

acdh-spacytei (>=0.0.1, <=0.0.5), ircrobots (0.3.6) potentially affected by CVE-2026-64847 via anyio (1.3.1)

anyio PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - acdh-spacytei =0.0.1, =0.0.5 - ircrobots 0.3.6 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

aio-net-events (0.2.0), aio-usb-hotplug (>=2.0.0, <=3.0.1) +11 more potentially affected by CVE-2026-64847 via anyio (2.2.0)

anyio PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aio-net-events 0.2.0 - aio-usb-hotplug =2.0.0, =0.9.1, =0.6.0, =0.1.0, =1.6.3, =0.0.1, =3.0.0, =0.1.0, =0.2.0 Source cves: CVE-2026-64847 Source...

ircrobots (>=0.3.7, <=0.7.2), smtpproto (1.0.0) potentially affected by CVE-2026-64847 via anyio (2.0.2)

anyio PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - ircrobots =0.3.7, =0.7.2 - smtpproto 1.0.0 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-64847 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

ircrobots (>=0.2.4, <=0.3.5) potentially affected by CVE-2026-64847 via anyio (1.3.0)

anyio PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - ircrobots =0.2.4, =0.3.5 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

geometron (>=0.0.1.dev7, <=0.0.3), metaplex-python-api (>=1.0.0, <=1.3.0) +1 more potentially affected by CVE-2026-64847 via anyio (3.3.4)

anyio PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - geometron =0.0.1.dev7, =1.0.0, =1.4.46, =3.0.3 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

aiopath (>=0.5.7, <=0.6.7), asiva (>=1.0.1, <=1.3.1) +1 more potentially affected by CVE-2026-64847 via anyio (3.1.0)

anyio PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiopath =0.5.7, =1.0.1, =1.0.1, =1.0.6 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-63374 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-63374 Source advisory: OSV:PYSEC-2026-4025...

geometron (>=0.0.1.dev7, <=0.0.3), metaplex-python-api (>=1.0.0, <=1.3.0) +1 more potentially affected by CVE-2026-63374 via anyio (3.3.4)

anyio PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - geometron =0.0.1.dev7, =1.0.0, =1.4.46, =3.0.3 Source cves: CVE-2026-63374 Source advisory: OSV:PYSEC-2026-4025...