Answer in brief
CVE-2026-63374 records a Critical severity (CVSS 9.3) vulnerability in AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing. The current sources do not mark it as known exploited. The current feed maps agronholm/anyio (generic), anyio (pip), anyio (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps agronholm/anyio (generic), anyio (pip), anyio (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| agronholm/anyiogeneric | <4.14.2 | 4.14.2 |
| anyiopip | <4.14.2 | 4.14.2 |
| anyiopypi | >=0 <4.14.2 | 4.14.2 |
Published upstream
Sep 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 18, 2026
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.
Quoted source text, attributed separately from HOL analysis.