Most recent entries from all

CVE-2026-64847 — AnyIO process-pool workers can block indefinitely on undrained stderr

2026-09-29T18:05:23.624443+00:00

Affected: agronholm anyio

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool call to remain blocked indefinitely. Applications that run untrusted or faulty worker code capable of producing substantial standard-error output are affected. This issue is fixed in version 4.14.2.

GHSA-5p39-cfhj-2xmp — AnyIO process-pool workers can block indefinitely on undrained stderr

2026-09-29T18:05:23.624525+00:00

Affected: PyPI: anyio

### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call.

Anyone who runs untrusted or faulty code that writes too much to `stderr` is at risk.

### Patches This vulnerability will be patched in v4.14.2.

### Workarounds Closing `sys.stderr` in the target function should at least prevent the deadlock.