Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-63374AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Critical 9.3

In plain English

A critical-severity improper certificate validation in anyio from agronholm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.3%top 78.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-anyiono fix listedDEBIAN-CVE-2026-63374
Debian:13python-anyiono fix listedDEBIAN-CVE-2026-63374
Debian:14python-anyio4.15.1-1DEBIAN-CVE-2026-63374
PyPIanyio4.14.2GHSA-82r6-8w77-94w6
PyPIanyio4.14.2PYSEC-2026-4025
Ubuntu:22.04:LTSpython-anyiono fix listedUBUNTU-CVE-2026-63374
Ubuntu:24.04:LTSpython-anyiono fix listedUBUNTU-CVE-2026-63374
Ubuntu:26.04:LTSpython-anyiono fix listedUBUNTU-CVE-2026-63374
Ubuntu:26.10python-anyiono fix listedUBUNTU-CVE-2026-63374

Affected products (as reported)

VendorProductVersions
agronholm anyio < 4.14.2

Weakness: CWE-295, CWE-297 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References