CVE-2026-64847 Details

A deadlock vulnerability has been identified in AnyIO, a high-level asynchronous concurrency and networking framework, prior to version 4.14.2. The issue arises in process-pool workers, which are started with standard error connected to an undrained pipe. This configuration blocks the worker from returning its standard output response, causing the process-pool call to hang indefinitely. The problem occurs because, although the documentation states that all standard streams are redirected, the standard error is left connected to a pipe that the parent process never drains. As a result, worker code that writes a significant amount of data to standard error can fill the pipe and create a blockage. This vulnerability affects applications running untrusted or faulty worker code that generates substantial standard error output.

Users can upgrade to AnyIO version 4.14.2 or later, where this issue has been fixed. Alternatively, closing standard error in the worker function can prevent the deadlock.