Asynchronous Networking Framework Vulnerability in AnyIO

CVE-2026-64847

What is CVE-2026-64847?

The AnyIO framework, which facilitates high-level asynchronous concurrency and networking, has a significant vulnerability where process-pool workers can become blocked. This occurs due to the standard error stream being connected to a pipe that the parent process does not drain. If the worker code generates a high volume of error messages, it can fill the pipe, leading to indefinite blocking while waiting for a protocol response. Applications executing untrusted or faulty code may significantly suffer from this issue, as it can disrupt normal operations and lead to unresponsive processes. The vulnerability has been addressed in version 4.14.2, which users are recommended to upgrade to.

References