CVE-2026-63374
CriticalSummary
AnyIO's TLS connections to internationalized (non-ASCII) domain names may be vulnerable if the connection is hijacked and redirected to a malicious server, potentially allowing man-in-the-middle attacks.
Risk Assessment
This could compromise the integrity and confidentiality of data transmitted over TLS when using IDN domains with AnyIO.
Recommendation
Monitor for updates from the AnyIO project and apply patches as soon as they are available. Until then, exercise caution and consider additional certificate verification.
Other vulnerabilities in AnyIO
See all- CVE-2026-63349High
In AnyIO 4.14.0, open_process() forwards the group argument to the backend instead of extra_groups, despite accepting the extra_groups parameter. A call with extra_groups=[] to clear inherited supplementary groups can launch a child process that retains the parent's groups, weakening a privilege-dropping boundary. This affects POSIX applications using AnyIO subprocess helpers and is fixed in version 4.14.2.
- CVE-2026-64847Medium
In AnyIO prior to 4.14.2, process-pool workers were started with stderr connected to a pipe the parent never drained. Worker code writing enough data to sys.stderr could fill the pipe and block before returning the response, causing the awaiting process-pool call to remain blocked indefinitely.
Original NVD description (English source)
### Impact Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker woul