[pkg-vuln] CVE-2026-64847 in anyio@4.12.1 #775

New Issue

kert · 2026-09-19T06:01:57Z

kert commented

2026-09-19 06:01:57 +00:00

Severity: MEDIUM
Package: anyio @ 4.12.1
Fixed in: 4.14.2

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-64847

**Severity:** MEDIUM **Package:** `anyio` @ `4.12.1` **Fixed in:** `4.14.2` AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-64847

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-09-19 06:01:57 +00:00

kert added the ci quality labels 2026-09-19 06:01:57 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#775