Asynchronous Networking Framework Vulnerability in AnyIO

CVE-2026-63374

What is CVE-2026-63374?

AnyIO, a framework designed for high-level asynchronous concurrency and networking, has a vulnerability affecting its hostname validation process. Versions prior to 4.14.2 employ IDNA 2003 instead of the updated IDNA 2008 standard. This can lead to scenarios where an attacker can exploit non-ASCII domains. By hijacking or redirecting a connection, they could present a legitimate certificate issued for the ASCII equivalent of the hostname processed under IDNA 2003, ultimately allowing malicious endpoints to pass validation and compromise client connections. This vulnerability has been addressed in the 4.14.2 release.

References