GHSA-5p39-cfhj-2xmp

Suggest an improvement
Source
https://github.com/advisories/GHSA-5p39-cfhj-2xmp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5p39-cfhj-2xmp/GHSA-5p39-cfhj-2xmp.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-5p39-cfhj-2xmp
Aliases
Downstream
Published
2026-09-18T17:17:10Z
Modified
2026-09-18T17:30:10Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
AnyIO process-pool workers can block indefinitely on undrained stderr
Details

Impact

AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call.

Anyone who runs untrusted or faulty code that writes too much to stderr is at risk.

Patches

This vulnerability will be patched in v4.14.2.

Workarounds

Closing sys.stderr in the target function should at least prevent the deadlock.

Database specific 
{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-18T17:17:10Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / anyio

Package

Name
anyio
View open source insights on deps.dev
Purl
pkg:pypi/anyio

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.14.2

Affected versions

1.*
1.0.0a1
1.0.0a2
1.0.0b1
1.0.0b2
1.0.0rc1
1.0.0rc2
1.0.0
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
1.3.0
1.3.1
1.4.0
2.*
2.0.0b1
2.0.0b2
2.0.0rc1
2.0.0rc2
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
3.*
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0
3.0.1
3.1.0
3.2.0
3.2.1
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.5.0
3.6.0
3.6.1
3.6.2
3.7.0rc1
3.7.0
3.7.1
4.*
4.0.0rc1
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
4.5.0
4.5.1
4.5.2
4.6.0
4.6.1
4.6.2
4.6.2.post1
4.7.0
4.8.0
4.9.0
4.10.0
4.11.0
4.12.0
4.12.1
4.13.0
4.14.0
4.14.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5p39-cfhj-2xmp/GHSA-5p39-cfhj-2xmp.json"