CVE-2026-63374
Severity not reportedAnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce security-advisories@github.com
- https://github.com/agronholm/anyio/pull/1208 security-advisories@github.com
- https://github.com/agronholm/anyio/releases/tag/4.14.2 security-advisories@github.com
- https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6 security-advisories@github.com