Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-63374: AnyIO allows TLS certificate spoofing on non‑ASCII domains
CVE-2026-63374 · published 20 days ago
Summary
AnyIO versions before 4.14.2 can misinterpret international web addresses, letting an attacker use a legitimate certificate for a different domain. If a connection to a site with non‑English characters is redirected, the wrong certificate may appear trusted. Update AnyIO to version 4.14.2 or later to stop this from happening.
What to do
- Update anyio to version 4.14.2.
- Update anyio to version 4.13.0+aikido.1.
- Update alex grönholm anyio to version 4.14.2.
- Update anyio to version 3.7.1+aikido.1.
- Update anyio to version 4.12.1+aikido.1.
- Update debian python-anyio to version 4.15.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | agronholm | anyio | < 4.14.2 |
| pip | – | anyio |
< 4.14.2 Fix: upgrade to 4.14.2
|
| Root:PyPI | – | anyio |
< 4.13.0+aikido.1 < 3.7.1+aikido.1 < 4.12.1+aikido.1 Fix: upgrade to 4.13.0+aikido.1
|
| pip | alex grönholm | anyio |
< 4.14.2 Fix: upgrade to 4.14.2
|
| Debian:12 | debian | python-anyio | All versions |
| Ubuntu:22.04:LTS | canonical | python-anyio | All versions |
| Debian:14 | debian | python-anyio |
< 4.15.1-1 Fix: upgrade to 4.15.1-1
|
Original advisory text
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.
References
- https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6
- https://github.com/agronholm/anyio/pull/1208
- https://github.com/advisories/GHSA-82r6-8w77-94w6
- https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2...
- https://github.com/agronholm/anyio Product
- https://github.com/agronholm/anyio/releases/tag/4.14.2
- https://security-tracker.debian.org/tracker/CVE-2026-63374 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-63374 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-63374 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63374... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63374 Vendor Advisory
- https://pypi.org/project/anyio Product
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-295Improper Certificate Validation
CWE-297Improper Validation of Certificate with Host Mismatch
Timeline
Published22 Sep 2026
Updated12 Oct 2026
First seen18 Sep 2026
Sources
GHSA-82r6-8w77-94w6 · GHSA
CVE-2026-63374 · NVD
GHSA-82r6-8w77-94w6 · OSV
DEBIAN-CVE-2026-63374 · OSV
UBUNTU-CVE-2026-63374 · OSV
CVE-2026-63374 · MITRE
CVE-2026-63374 · OSV
PYSEC-2026-4025 · OSV
Track software like this
Free during beta