Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

anyio

3 known vulnerabilities (1 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
4.16.0 (Nov 1, 2026): no advisory affects it
Newest unaffected release
4.16.0 (Nov 1, 2026), the latest release
Advisories
3 · 1 critical, 1 high, 1 medium
Weekly downloads
231.6M
Releases
73 since 1.0.0 (May 14, 2019)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-63374Critical 9.3

    AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

    Affected: fixed in 4.14.2.

    Fixed in 4.14.2 (released Jul 12, 2026, 72 days before disclosure).

    The latest release, 4.16.0, is not affected.

  • CVE-2026-64847Medium 6.8

    AnyIO process-pool workers can block indefinitely on undrained stderr

    Affected: fixed in 4.14.2.

    Fixed in 4.14.2 (released Jul 12, 2026, 68 days before disclosure).

    The latest release, 4.16.0, is not affected.

  • AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

    Affected: from 4.14.0, fixed in 4.14.2.

    Fixed in 4.14.2 (released Jul 12, 2026, 68 days before disclosure).

    The latest release, 4.16.0, is not affected.