Threats tagged 'brew-fastmcp-cve-2026-63374'

AnyIO's TLSStream component uses IDNA 2003 encoding for internationalized domain names, which can enable TLS certificate spoofing. An attacker who hijacks and redirects a TLS connection to a malicious server can obtain a legitimate certificate for the IDNA 2003 encoded domain and present it to the client, causing the certificate to validate incorrectly. This vulnerability affects versions of fastmcp from 2.12.3 up to but not including 3.4.5. A fix is available in version 3.4.5. As a workaround, host names can be encoded using the 'idna' package before connecting.