Description
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.
Published: 2026-09-22
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: TLS certificate spoofing
Action: Patch
AI Analysis

Impact

Existing anyio versions before 4.14.2 perform hostname validation after converting non‑ASCII names with the older IDNA 2003 algorithm instead of the recommended IDNA 2008. This allows an attacker who can hijack or redirect traffic to a non‑ASCII domain to obtain a valid certificate for the ASCII hostname produced by IDNA 2003 and present it to the client, causing the certificate to be accepted as legitimate. The result is a man‑in‑the‑middle attack that can expose traffic and credentials, and the CVSS score of 9.3 reflects the high impact and wide scope of this flaw.

Affected Systems

The CVE affects the AnyIO concurrency framework from agronholm. Any installation running anyio versions prior to 4.14.2, particularly those calling connect_tcp() or TLSStream.wrap(), is vulnerable.

Risk and Exploitability

Exploitation requires the attacker to hijack or redirect a connection to a non‑ASCII domain. The CVSS score of 9.3 and the fact that the flaw allows certificate spoofing indicate a severe risk. The vulnerability is not yet listed in the CISA KEV catalog, and earlier releases remain without a mitigated fix.

Generated by OpenCVE AI on September 22, 2026 at 17:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade anyio to version 4.14.2 or later, which replaces IDNA 2003 with IDNA 2008 hostname validation.
  • If immediate upgrade is not possible, restrict outbound connections to trusted hosts and monitor for unexpected certificate changes, applying network‑level controls such as DNSSEC or TLS inspection to detect spoofed certificates.
  • If the application includes custom hostname validation logic, modify it to use IDNA 2008 instead of IDNA 2003.

Generated by OpenCVE AI on September 22, 2026 at 17:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-82r6-8w77-94w6 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
History

Wed, 30 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

threat_severity

Moderate

Mon, 28 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Agronholm
Agronholm anyio
Vendors & Products Agronholm
Agronholm anyio

Tue, 22 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.
Title AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
Weaknesses CWE-295
CWE-297
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Agronholm Anyio
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-28T16:32:29.169Z

Reserved: 2026-07-16T17:39:30.170Z

Link: CVE-2026-63374

cve-icon Vulnrichment

Updated: 2026-09-28T16:22:39.482Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-22T16:17:50.680

Modified: 2026-09-28T17:17:50.357

Link: CVE-2026-63374

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-22T15:23:14Z

Links: CVE-2026-63374 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T17:45:17Z

Weaknesses
  • CWE-295

    Improper Certificate Validation

  • CWE-297

    Improper Validation of Certificate with Host Mismatch