[pkg-vuln] CVE-2026-64847 in anyio@4.12.1 #775

New Issue

kert · 2026-09-19T06:01:57Z

kert commented

2026-09-19 06:01:57 +00:00

Severity: MEDIUM
Package: anyio @ 4.12.1
Fixed in: 4.14.2

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-64847

**Severity:** MEDIUM **Package:** `anyio` @ `4.12.1` **Fixed in:** `4.14.2` AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-64847

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-09-19 06:01:57 +00:00

kert added the ci quality labels 2026-09-19 06:01:57 +00:00

kert referenced this issue from a commit

2026-09-22 19:26:28 +00:00

build: bump anyio 4.12.1 -> 4.14.2 (CVE-2026-63374, CVE-2026-64847) (refs #774, #775)

kert commented

2026-09-22 19:33:08 +00:00

Fixed by 4452bc3 on main: uv lock --upgrade-package anyio → 4.14.2 (the fixed version named here). Lockfile-only change; tests/llm + tests/api (886 passed) and the full pre-commit selection ran green, and the pkg-supply-chain run on that commit (run 4060) succeeded. Closing.

Fixed by 4452bc3 on main: `uv lock --upgrade-package anyio` → 4.14.2 (the fixed version named here). Lockfile-only change; tests/llm + tests/api (886 passed) and the full pre-commit selection ran green, and the pkg-supply-chain run on that commit (run 4060) succeeded. Closing.

kert closed this issue

2026-09-22 19:33:08 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#775