CVE-2026-63374
Received Received - Intake

Internationalized Domain Name Validation Bypass in AnyIO

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-63374
EUVD
EUVD-2026-84522

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
agronholm anyio to 4.14.2 (exc)
anyio anyio 4.14.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in AnyIO versions before 4.14.2 involves incorrect handling of internationalized domain names (IDNs) in TLS connections. The library used IDNA 2003 instead of IDNA 2008 to encode hostnames, which could allow attackers to spoof certificates for malicious endpoints. When a connection is hijacked or redirected, the attacker can present a legitimate certificate for the IDNA 2003 encoded hostname, tricking the client into accepting the malicious server.

Detection Guidance

To detect this vulnerability, check if your AnyIO library version is below 4.14.2. Run: pip show anyio or pip list | grep anyio. If the version is <=4.14.1, the system is vulnerable. Additionally, inspect network traffic for TLS connections to internationalized domains using tools like Wireshark or tcpdump to identify potential certificate mismatches.

Impact Analysis

This vulnerability could allow attackers to intercept or redirect TLS traffic to malicious servers without detection. If you use AnyIO with internationalized domain names in versions before 4.14.2, your application might connect to an attacker-controlled server that appears legitimate due to a valid certificate. This could lead to data breaches, unauthorized access, or man-in-the-middle attacks.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and integrity, such as GDPR's encryption standards or HIPAA's safeguards for electronic protected health information. Unauthorized interception or tampering with TLS traffic may result in non-compliance, potential fines, or legal liabilities due to compromised data confidentiality and integrity.

Mitigation Strategies

Upgrade AnyIO to version 4.14.2 or later immediately. If upgrading is not possible, implement a workaround by encoding host names using the idna package before connecting. Review and update TLS certificate validation logic to ensure IDNA 2008 compliance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart