CVE-2026-64847

NameCVE-2026-64847
DescriptionAnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool call to remain blocked indefinitely. Applications that run untrusted or faulty worker code capable of producing substantial standard-error output are affected. This issue is fixed in version 4.14.2.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1148561

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-anyio (PTS)bookworm3.6.2-1vulnerable
trixie4.8.0-3vulnerable
forky, sid4.12.1-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-anyiosource(unstable)(unfixed)1148561

Notes

https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp
https://github.com/agronholm/anyio/pull/1207
https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 (4.14.2)

Search for package or bug name: Reporting problems