{"id":"CVE-2026-64847","aliases":["GHSA-5p39-cfhj-2xmp","PYSEC-2026-4024"],"url":"https://o3.security/vulnerability/CVE-2026-64847","summary":"AnyIO process-pool workers can block indefinitely on undrained stderr","details":"### Impact\nAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call.\n\nAnyone who runs untrusted or faulty code that writes too much to `stderr` is at risk.\n\n### Patches\nThis vulnerability will be patched in v4.14.2.\n\n### Workarounds\nClosing `sys.stderr` in the target function should at least prevent the deadlock.","published":"2026-09-18T17:04:32.038Z","modified":"2026-10-28T02:30:57.055742222Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"anyio","fixedVersion":"4.14.2"}],"fix":{"url":"https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040","label":"agronholm/anyio@f1b7301"},"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64847.json"},{"type":"ADVISORY","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64847"},{"type":"FIX","url":"https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"},{"type":"FIX","url":"https://github.com/agronholm/anyio/pull/1207"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:57.055742222Z"}}