anyio vulnerabilities

2 known vulnerabilities in anyio from Agronholm. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  anyio: Improper Certificate Validation

  CVE-2026-63374Sep 22, 2026Agronholm

  AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDN

• 7.0 High severity

  anyio: Incorrect Privilege Assignment

  CVE-2026-63349Sep 18, 2026Agronholm

  AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group