Skip to content
CVE IDCVE-2026-63374GitHub advisory IDGHSA-82r6-8w77-94w6

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

CVE-2026-63374 (GitHub advisory GHSA-82r6-8w77-94w6) is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3, classed as Improper Certificate Validation (CWE-295), in anyio (PyPI). Affected versions: < 4.14.2. It is fixed in 4.14.2.

Critical9.3Fix availableGitHub reviewed

Published 18 Sept 2026Updated 18 Sept 2026

9.3CriticalCVSS 4.0
CVE ID
CVE-2026-63374
GHSA ID
GHSA-82r6-8w77-94w6
EPSS
Not scored
Weaknesses (CWE)
  • CWE-295Improper Certificate Validation
  • CWE-297Improper Validation of Certificate with Host Mismatch
KEV status
Not in KEV
Published
18 Sept 2026
Updated
18 Sept 2026
Ecosystem
  • PyPI

Summary

Source: OSV (GitHub advisory)

Impact

Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's connect_tcp() or directly via TLSStream.wrap() where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker would obtain a legitimate certificate using the IDNA 2003 encoded version of the domain name and offer it to the connecting client, making the certificate validate properly on the client's end.

Patches

The vulnerability will be patched in v4.14.2.

Workarounds

Encode host names via the idna package prior to connecting.

Technical details

Source: GitHub Advisory Database

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Critical9.3Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Attack Requirements AT
None
Privileges Required PR
None
User Interaction UI
None
Confidentiality (Vulnerable System) VC
High
Integrity (Vulnerable System) VI
High
Availability (Vulnerable System) VA
None
Confidentiality (Subsequent Systems) SC
None
Integrity (Subsequent Systems) SI
None
Availability (Subsequent Systems) SA
None

Affected packages

Source: OSV (GitHub advisory)

  • anyio
    PyPI
    pkg:pypi/anyio
    Affected versions
    < 4.14.2
    Fixed in
    4.14.2
    Show 69 listed versions
    • 1.0.0
    • 1.0.0a1
    • 1.0.0a2
    • 1.0.0b1
    • 1.0.0b2
    • 1.0.0rc1
    • 1.0.0rc2
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 1.2.2
    • 1.2.3

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 4.14.2 or later.

Patch commits

  • 68f5891Patch commitgithub.com/agronholm/anyio

    Fixed TLSStream.wrap() using IDNA 2003 instead of IDNA 2008 (#1208)

    +99 −13 across 5 files

    • docs/versionhistory.rst+4 −0
    • src/anyio/_core/_sockets.py+10 −10
    • src/anyio/streams/tls.py+14 −2
    • tests/streams/test_tls.py+41 −0
    • tests/test_sockets.py+30 −1
  • #1208Pull requestgithub.com/agronholm/anyio

Vulnerability intelligence

References

Questions about CVE-2026-63374

What is the GHSA ID for CVE-2026-63374?
GitHub tracks CVE-2026-63374 as GHSA-82r6-8w77-94w6.
What is the CVSS score of CVE-2026-63374?
CVE-2026-63374 has a CVSS 4.0 base score of 9.3 (Critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N.
Which versions are affected by CVE-2026-63374?
anyio (PyPI): < 4.14.2.
How do I fix CVE-2026-63374?
Upgrade to 4.14.2 or later. The fix is in commit 68f5891 and pull request #1208.
What is the Package URL (PURL) for CVE-2026-63374?
The affected package's PURL is pkg:pypi/anyio.
Is CVE-2026-63374 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-63374. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)No record
  • CVE.orgNo record
  • CISA KEV catalogLoaded
  • FIRST EPSSUnavailable

Fetched 2 days ago (13 Oct 2026, 13:26 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
KEV status
CISA KEV catalog

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.