CVE-2026-63374criticalCWE-295CWE-297

CVE-2026-63374: falha crítica em agronholm anyio

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar anyio+ Monitorar python-anyio

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.3%
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
agronholm · anyio
CVEs relacionadas — agronholm anyio

No mesmo produto, das mais perigosas para as menos.

CVE-2026-64847MEDIUMAnyIO process-pool workers can block indefinitely on undrained stderrEPSS 0.2%CVE-2026-63349HIGHAnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsEPSS 0.1%