What’s Vulnerable › Vulnerabilities

CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr

• Severity: medium (CVSS 6.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-09-24
• Weakness: CWE-770

Description

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool call to remain blocked indefinitely. Applications that run untrusted or faulty worker code capable of producing substantial standard-error output are affected. This issue is fixed in version 4.14.2.

Affected products

• agronholm anyio: before 4.14.2

References

• https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040
• https://github.com/agronholm/anyio/pull/1207
• https://github.com/agronholm/anyio/releases/tag/4.14.2
• https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp

Get alerted when CVE-2026-64847 or the next vulnerability affects your stack