https://vulnerability.circl.lu/sightings/feed 2026-09-19T16:58:28.830311+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/435410e5-72c1-4667-a89e-680a42226292/export 2026-09-19T16:58:28.861369+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "435410e5-72c1-4667-a89e-680a42226292", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64847", "type": "seen", "source": "https://gist.github.com/alon710/d2d38cc91e8e28c2c97b7ca219941b98", "content": "# CVE-2026-64847: CVE-2026-64847: Indefinite Denial of Service via Undrained Stderr in AnyIO Process Pool Workers\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-64847\n\n## Summary\nA denial-of-service vulnerability exists in AnyIO prior to version 4.14.2. Standard error streams of process-pool workers are connected to an operating system pipe that is never drained by the parent process. This allows a worker to fill the pipe buffer and deadlock indefinitely.\n\n## TL;DR\nAnyIO process-pool workers can block indefinitely when writing to undrained stderr streams, causing a permanent deadlock of the calling event loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Local (AV:L)\n- **CVSS Score**: 6.8 (Medium)\n- **EPSS Score**: Not currently indexed\n- **Impact**: High Availability Impact (Denial of Service)\n- **Exploit Status**: PoC\n- **KEV Status**: Not listed in CISA KEV\n\n## Affected Systems\n\n- AnyIO Python asynchronous concurrency framework\n- **anyio**: < 4.14.2 (Fixed in: `4.14.2`)\n\n## Mitigation\n\n- Upgrade AnyIO to version 4.14.2 or later\n- Manually redirect sys.stderr within task functions to os.devnull in vulnerable versions\n- Configure execution timeouts using anyio.fail_after to prevent infinite blocking of the parent process loop\n\n**Remediation Steps:**\n1. Verify the currently installed AnyIO version using pip show anyio\n2. Update the library to the patched version using pip install --upgrade anyio>=4.14.2\n3. Ensure application tests cover tasks that generate high volumes of diagnostic output to confirm deadlock resilience\n\n## References\n\n- [GitHub Security Advisory GHSA-5p39-cfhj-2xmp](https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp)\n- [AnyIO Pull Request #1207](https://github.com/agronholm/anyio/pull/1207)\n- [AnyIO Patch Commit f1b7301](https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040)\n- [NVD - CVE-2026-64847](https://nvd.nist.gov/vuln/detail/CVE-2026-64847)\n- [Wiz Vulnerability Database Details](https://www.wiz.io/vulnerability-database/cve/cve-2026-64847)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-64847) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T14:31:33.898725Z"} 2026-09-19T14:31:33.898725+00:00