[pkg-vuln] CVE-2026-63374 in anyio@4.12.1 #774

New Issue

kert · 2026-09-19T06:01:57Z

kert commented

2026-09-19 06:01:57 +00:00

Severity: CRITICAL
Package: anyio @ 4.12.1
Fixed in: 4.14.2

Impact

Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's connect_tcp() or directly via TLSStream.wrap() where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker would obtain a legitimate certificate using the IDNA 2003 encoded version of the domain name and offer it to the connecting client, making the certificate validate properly on the client's end.

Patch

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-63374

**Severity:** CRITICAL **Package:** `anyio` @ `4.12.1` **Fixed in:** `4.14.2` ### Impact Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker would obtain a legitimate certificate using the IDNA 2003 encoded version of the domain name and offer it to the connecting client, making the certificate validate properly on the client's end. ### Patch **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-63374

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-09-19 06:01:57 +00:00

kert added the ci quality labels 2026-09-19 06:01:57 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#774