PyPI/anyio CVE-2026-64847: unknown, EPSS 0.16%

AnyIO process-pool workers can block indefinitely on undrained stderr

Action: Upgrade anyio to 4.14.2 or later.

pip install anyio==4.14.2

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4024
• https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp
• https://github.com/agronholm/anyio/pull/1207
• https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040
• https://github.com/agronholm/anyio
• https://github.com/agronholm/anyio/releases/tag/4.14.2
• https://pypi.org/project/anyio
• https://github.com/advisories/GHSA-5p39-cfhj-2xmp
• https://nvd.nist.gov/vuln/detail/CVE-2026-64847

CVE-2026-64847 · published 2026-10-01T16:38:33.524594Z · modified 2026-10-01T17:45:01.995149284Z · JSON