CVE-2026-64847: CWE-770: Allocation of Resources Without Limits or Throttling in agronholm anyio
### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call. Anyone who runs untrusted or faulty code that writes too much to `stderr` is at risk. ### Patches This vulnerability will be patched in v4.14.2. ### Workarounds Closing `sys.stderr` in the target function should at least prevent the deadlock.
AI Analysis
Technical Summary
AnyIO, an asynchronous concurrency framework, improperly handles standard error pipes for process-pool workers in versions before 4.14.2. The parent process does not drain the stderr pipe, so if worker code writes enough data to sys.stderr, the pipe fills and blocks the worker before it can return the standard-output protocol response. This causes the awaiting process-pool call to block indefinitely. The vulnerability is identified as CWE-770 (Allocation of Resources Without Limits or Throttling) and is fixed in AnyIO 4.14.2.
Potential Impact
Applications using AnyIO versions prior to 4.14.2 that run untrusted or faulty worker code capable of producing large amounts of standard-error output may experience indefinite blocking of process-pool calls. This can lead to denial of service conditions where asynchronous tasks hang and do not complete.
Mitigation Recommendations
Upgrade AnyIO to version 4.14.2 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory.
CVE-2026-64847: CWE-770: Allocation of Resources Without Limits or Throttling in agronholm anyio
Description
### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call. Anyone who runs untrusted or faulty code that writes too much to `stderr` is at risk. ### Patches This vulnerability will be patched in v4.14.2. ### Workarounds Closing `sys.stderr` in the target function should at least prevent the deadlock.
CVSS v4.0
Score 6.8medium
Affected software
agronholm
anyio
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
AnyIO, an asynchronous concurrency framework, improperly handles standard error pipes for process-pool workers in versions before 4.14.2. The parent process does not drain the stderr pipe, so if worker code writes enough data to sys.stderr, the pipe fills and blocks the worker before it can return the standard-output protocol response. This causes the awaiting process-pool call to block indefinitely. The vulnerability is identified as CWE-770 (Allocation of Resources Without Limits or Throttling) and is fixed in AnyIO 4.14.2.
Potential Impact
Applications using AnyIO versions prior to 4.14.2 that run untrusted or faulty worker code capable of producing large amounts of standard-error output may experience indefinite blocking of process-pool calls. This can lead to denial of service conditions where asynchronous tasks hang and do not complete.
Mitigation Recommendations
Upgrade AnyIO to version 4.14.2 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-20T18:31:39.290Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aad759f55bf5e2cf54f3596
Added to database: 09/18/2026, 17:32:15 UTC
Last enriched: 09/18/2026, 17:47:14 UTC
Last updated: 09/19/2026, 02:19:16 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.