CVE-2026-64847: Indefinite Denial of Service via Undrained Stderr in AnyIO Process Pool Workers
Vulnerability ID: CVE-2026-64847
CVSS Score: 6.8
Published: 2026-09-18
A denial-of-service vulnerability exists in AnyIO prior to version 4.14.2. Standard error streams of process-pool workers are connected to an operating system pipe that is never drained by the parent process. This allows a worker to fill the pipe buffer and deadlock indefinitely.
TL;DR
AnyIO process-pool workers can block indefinitely when writing to undrained stderr streams, causing a permanent deadlock of the calling event loop.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-770
- Attack Vector: Local (AV:L)
- CVSS Score: 6.8 (Medium)
- EPSS Score: Not currently indexed
- Impact: High Availability Impact (Denial of Service)
- Exploit Status: PoC
- KEV Status: Not listed in CISA KEV
Affected Systems
- AnyIO Python asynchronous concurrency framework
-
anyio: < 4.14.2 (Fixed in:
4.14.2)
Code Analysis
Commit: f1b7301
Redirect worker stderr to devnull to avoid deadlocks when pipe is filled
Exploit Details
- GitHub Advisory / Official Regression Test: Proof of concept demonstrating worker deadlock by flooding standard error with large data buffers.
Mitigation Strategies
- Upgrade AnyIO to version 4.14.2 or later
- Manually redirect sys.stderr within task functions to os.devnull in vulnerable versions
- Configure execution timeouts using anyio.fail_after to prevent infinite blocking of the parent process loop
Remediation Steps:
- Verify the currently installed AnyIO version using pip show anyio
- Update the library to the patched version using pip install --upgrade anyio>=4.14.2
- Ensure application tests cover tasks that generate high volumes of diagnostic output to confirm deadlock resilience
References
- GitHub Security Advisory GHSA-5p39-cfhj-2xmp
- AnyIO Pull Request #1207
- AnyIO Patch Commit f1b7301
- NVD - CVE-2026-64847
- Wiz Vulnerability Database Details
Read the full report for CVE-2026-64847 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)