CVE-2026-64847 is a vulnerability in mcp-proxy's AnyIO process-pool workers where stderr is connected to a pipe but never drained. This can cause the pipe to fill and block the worker if too much data is written to stderr, leading to indefinite blocking of the process-pool call. The issue affects versions from 0.8.2 up to but not including 0.12.0_4. A patch is available in version 0.12.0_4. Closing sys.stderr in the target function can mitigate the deadlock risk.