CVE-2026-63374: agronholm anyio Improper Certificate Validation
Vulnerability summary
CVE-2026-63374 is a critical (CVSS 9.3) Improper Certificate Validation vulnerability in agronholm anyio. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 22-09-2026PublishedVulnerability first disclosed.
- 28-09-2026Last modifiedVulnerability information updated.
Description
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
- CWE-297Improper Validation of Certificate with Host MismatchThe product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Affected systems
Chainguard16 products
- airflow-2< 2.11.2-r23
- airflow-core-2< 2.11.2-r8
- authentik-2025.12All versions (No fix recorded)
- authentik-2026.2All versions (No fix recorded)
- authentik-2026.5< 2026.5.7-r2
Wolfi3 products
- kserve-storage-controller< 0.20.0-r9
- open-webui< 0.11.3-r7
- py3.14-anyio< 4.15.1-r1
Agronholm1 product
- anyio< 4.14.2
Debian1 product
- python-anyioAll versions (No fix recorded) | < 4.15.1-1
PyPI1 product
- anyio< 4.14.2
Ubuntu1 product
- python-anyioAll versions (No fix recorded)
6 vendors · 23 products
References
12 links- github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6X Refsource CONFIRMWEBREPORTAdvisory
- github.com/agronholm/anyioPACKAGE
- pypi.org/project/anyioPACKAGE
