CVE-2026-64847
mediumpriority · track · 0EPSS 0.002 · 5 %ileFRUSEPSS · scored 2026-10-28
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool call to remain blocked indefinitely. Applications that run untrusted or faulty worker code capable of producing substantial standard-error output are affected. This issue is fixed in version 4.14.2.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-5p39-cfhj-2xmpAnyIO process-pool workers can block indefinitely on undrained stderr2026-09-18ghsa · osvUS
### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call. Anyone who runs untrusted or faulty code that writes too much to `stderr` is at risk. ### Patches This vulnerability will be patched in v4.14.2. ### Workarounds Closing `sys.stderr` in the target function should at least prevent the deadlock.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- PYSEC-2026-4024AnyIO process-pool workers can block indefinitely on undrained stderr2026-10-01vendor · osvUS
### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call. Anyone who runs untrusted or faulty code that writes too much to `stderr` is at risk. ### Patches This vulnerability will be patched in v4.14.2. ### Workarounds Closing `sys.stderr` in the target function should at least prevent the deadlock.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan