Threats tagged 'brew-mcp-proxy-cve-2026-63374'

AnyIO's TLSStream uses IDNA 2003 encoding for internationalized domain names, which can enable TLS certificate spoofing. An attacker who hijacks and redirects a TLS connection to a malicious server can obtain a legitimate certificate for the IDNA 2003 encoded domain and present it to the client, causing the client to accept the spoofed certificate. This vulnerability affects versions from 0.8.2 up to but not including 0.12.0_4. A fix is available in version 0.12.0_4. As a workaround, host names can be encoded using the 'idna' package before connecting.