PyPI/anyio CVE-2026-63374: critical, EPSS 0.29%

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Action: Upgrade anyio to 4.14.2 or later.

pip install anyio==4.14.2

Affected

Fixed versions

Sources

• osv: GHSA-82r6-8w77-94w6
• https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6
• https://github.com/agronholm/anyio/pull/1208
• https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce
• https://github.com/agronholm/anyio
• https://github.com/agronholm/anyio/releases/tag/4.14.2

CVE-2026-63374 · published 2026-09-18T17:17:18Z · modified 2026-10-01T17:56:11.058322399Z · JSON