Threats affecting pkg:pypi/anyio

AnyIO versions prior to 4.14.2 contain a resource allocation vulnerability where process-pool workers' standard error pipes are not drained by the parent process. This can cause the pipe to fill and block the worker if it writes enough data to stderr, leading to indefinite blocking of the process-pool call. The issue affects applications running untrusted or faulty worker code that produces substantial standard error output. The vulnerability is fixed in AnyIO version 4.14.2.

CVE-2026-63349 is a privilege assignment vulnerability in AnyIO versions 4.14.0 up to but not including 4.14.2. The issue arises because anyio.open_process() incorrectly forwards the extra_groups argument, causing child processes to retain parent supplementary groups instead of properly clearing or setting them. This affects POSIX privilege dropping correctness in applications relying on AnyIO subprocess helpers. The flaw can also cause a TypeError if conflicting arguments are supplied.