CVE-2026-64847

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

CVE-2026-64847

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

UBUNTU-CVE-2026-64847

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

Incorrect Privilege Assignment

Overview anyio is a High level compatibility layer for multiple asynchronous event loop implementations Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the openprocess function in src/anyio/core/subprocesses.py, where the extragroups parameter is silently...

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

GHSA-3W57-8XMC-8V26 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

aindy-runtime (>=1.5.0, <=1.11.0), amarcord (>=1.5.0, <=1.5.2) +23 more potentially affected by CVE-2026-63349 via anyio (>=4.14.0, <=4.14.1)

anyio PYPI version =4.14.0, =1.5.0, =1.5.0, =0.0.3, =1.8.0, =0.10.2, =0.1.4, =2.19.0, =1.3.1, =0.1.1, =0.1.0, =0.0.1a1, =1.0.0a1, =0.0.1a1, =1.0.0 and more Source cves: CVE-2026-63349 Source advisory: GHSA-3W57-8XMC-8V26...

octomachinery (>=0.2.3, <=0.3.11), purerpc (>=0.2.0, <=0.3.2) potentially affected by CVE-2026-63374 via anyio (2.0.0rc2)

anyio PYPI version 2.0.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - octomachinery =0.2.3, =0.2.0, =0.3.2 Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-94W6...

GHSA-82R6-8W77-94W6 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

ircrobots (>=0.3.7, <=0.7.2), smtpproto (1.0.0) potentially affected by CVE-2026-63374 via anyio (2.0.2)

anyio PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - ircrobots =0.3.7, =0.7.2 - smtpproto 1.0.0 Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-94W6...

aac (>=0.1.10, <=0.5.21), aac-bom (>=0.0.1, <=0.0.4) +71 more potentially affected by CVE-2026-63374 via anyio (3.6.2)

anyio PYPI version 3.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aac =0.1.10, =0.0.1, =0.1.0, =0.1.3, =0.0.1, =0.1.5, =0.1.1, =0.0.3, =0.1.1, =0.4.2, =0.0.1, =0.1.0, =0.3.0 and more Source cves: CVE-2026-63374 Sourc...

5mghost-rover (>=0.0.1, <=0.0.3), aaaai (>=0.1.3, <=0.3.0) +853 more potentially affected by CVE-2026-63374 via anyio (>=4.0.0rc1, <=4.14.1)

anyio PYPI version =4.0.0rc1, =0.0.1, =0.1.3, =0.6.0, =0.0.32, =0.0.1, =4.8.2, =0.1.3, =0.1.0, =0.4.0, =0.1.1, =0.1.0, =0.1.31, =0.1.0, =0.0.2, =0.4.0rc1, =0.7.1 and more Source cves: CVE-2026-63374 Source advisory: SNYK:PYTHON-ANYIO-19958324...

agl-ocr-reader (1.1.1), app-ocr (>=0.0.1, <=1.2.14) +7 more potentially affected by CVE-2026-63374 via anyio (3.7.0)

anyio PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - agl-ocr-reader 1.1.1 - app-ocr =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.2.0 - yt-fts 0.1.6 Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-9...

machine-web (>=0.0.1, <=0.0.2.post2) potentially affected by CVE-2026-63374 via anyio (3.3.2)

anyio PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - machine-web =0.0.1, =0.0.2.post2 Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-94W6...

5mghost-rover (>=0.0.1, <=0.0.3), aaaai (>=0.1.3, <=0.3.0) +853 more potentially affected by CVE-2026-63374 via anyio (>=4.0.0rc1, <=4.14.1)

anyio PYPI version =4.0.0rc1, =0.0.1, =0.1.3, =0.6.0, =0.0.32, =0.0.1, =4.8.2, =0.1.3, =0.1.0, =0.4.0, =0.1.1, =0.1.0, =0.1.31, =0.1.0, =0.0.2, =0.4.0rc1, =0.7.1 and more Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-94W6...

aio-net-events (0.2.0), aio-usb-hotplug (>=2.0.0, <=3.0.1) +11 more potentially affected by CVE-2026-63374 via anyio (2.2.0)

anyio PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aio-net-events 0.2.0 - aio-usb-hotplug =2.0.0, =0.9.1, =0.6.0, =0.1.0, =1.6.3, =0.0.1, =3.0.0, =0.1.0, =0.2.0 Source cves: CVE-2026-63374 Source...

omniblack-model (>=0.1.1, <=0.1.4.post5) potentially affected by CVE-2026-63374 via anyio (3.0.0)

anyio PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - omniblack-model =0.1.1, =0.1.4.post5 Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-94W6...

Improper Validation of Certificate with Host Mismatch

Overview anyio is a High level compatibility layer for multiple asynchronous event loop implementations Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via TLSStream.wrap in src/anyio/streams/tls.py, which resolves international domain nam...

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

5mghost-rover (>=0.0.1, <=0.0.3), aaaai (>=0.1.3, <=0.3.0) +853 more potentially affected by CVE-2026-63374 via anyio (>=4.0.0rc1, <=4.14.1)

anyio PYPI version =4.0.0rc1, =0.0.1, =0.1.3, =0.6.0, =0.0.32, =0.0.1, =4.8.2, =0.1.3, =0.1.0, =0.4.0, =0.1.1, =0.1.0, =0.1.31, =0.1.0, =0.0.2, =0.4.0rc1, =0.7.1 and more Source cves: CVE-2026-63374 Source advisory: GHSA-82R6-8W77-94W6...