CVE-2026-63374

CVSS 9.3 (critical) · published 2026-09-22

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.

Weakness: CWE-295, CWE-297

Source: NVD CVE-2026-63374

References

• https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce
• https://github.com/agronholm/anyio/pull/1208
• https://github.com/agronholm/anyio/releases/tag/4.14.2
• https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.