CVE-2026-64847

Name of the Vulnerable Software and Affected Versions AnyIO versions prior to 4.14.2

Description AnyIO starts process-pool workers with the standard error stream connected to a pipe that the parent process never drains. Although documentation states all three standard streams are redirected, the worker only redirects stdin and stdout to /dev/null. If worker code writes a significant amount of attacker-influenced data to sys.stderr, the pipe can fill up and block the worker before it returns the standard-output protocol response. This results in the awaiting process-pool call remaining blocked indefinitely, leading to a denial of service. This issue affects applications that execute untrusted or faulty worker code capable of producing substantial standard-error output.

Recommendations Update to version 4.14.2. As a temporary workaround, close sys.stderr in the target function to prevent the deadlock.