Source: python-anyio X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for python-anyio. CVE-2026-64847[0]: | AnyIO is a high level asynchronous concurrency and networking | framework that works on top of either Trio or asyncio. Prior to | 4.14.2, AnyIO starts process-pool workers with standard error | connected to a pipe that the parent never drains, even though the | documented behavior redirects all three standard streams. Worker | code that writes enough attacker-influenced data to sys.stderr can | fill the pipe and block before returning the standard-output | protocol response, causing the awaiting process-pool call to remain | blocked indefinitely. Applications that run untrusted or faulty | worker code capable of producing substantial standard-error output | are affected. This issue is fixed in version 4.14.2. https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp https://github.com/agronholm/anyio/pull/1207 https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 (4.14.2) CVE-2026-63349[1]: | AnyIO is a high level asynchronous concurrency and networking | framework that works on top of either Trio or asyncio. In 4.14.0, | AnyIO accepts the POSIX extra_groups argument in anyio.run_process() | and anyio.open_process(), but open_process() forwards the group | argument to the backend instead of extra_groups. A caller that | supplies extra_groups=[] to clear inherited supplementary groups can | therefore launch a child that retains the parent process groups, | undermining a privilege-dropping boundary. If group is also | supplied, the integer group value is passed where an iterable of | supplementary groups is expected and the launch can fail with | TypeError. This issue affects POSIX applications that rely on AnyIO | subprocess helpers to launch less-privileged child processes. This | issue is fixed in version 4.14.2. https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26 https://github.com/agronholm/anyio/pull/1209 https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200 (4.14.2) CVE-2026-63374[2]: https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6 If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-64847 https://www.cve.org/CVERecord?id=CVE-2026-64847 [1] https://security-tracker.debian.org/tracker/CVE-2026-63349 https://www.cve.org/CVERecord?id=CVE-2026-63349 [2] https://security-tracker.debian.org/tracker/CVE-2026-63374 https://www.cve.org/CVERecord?id=CVE-2026-63374 Please adjust the affected versions in the BTS as needed.
