Threats tagged 'brew-llm-cve-2026-63374'

AnyIO versions from 0.13.1 up to but not including 0.32 are vulnerable to a TLS certificate spoofing issue due to the use of IDNA 2003 host name encoding in TLSStream. This allows an attacker who hijacks and redirects a TLS connection to present a legitimate certificate encoded with IDNA 2003, which the client will validate successfully. The vulnerability is critical with a CVSS 4.0 score of 9.3. A fix is available in version 0.32, and a workaround is to encode host names using the 'idna' package before connecting.