anyio (PyPI)
High level asynchronous concurrency and networking framework that works on top of either Trio or asyncio
Advisories
9
Latest version
4.15.1
Released Sep 5, 2026
License
MIT
OpenSSF Scorecard
5.6 / 10
How to fix
Upgrading to 4.14.2 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "anyio>=4.15.1"poetry
poetry add "anyio>=4.15.1"uv
uv add "anyio>=4.15.1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-82r6-8w77-94w6 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
Critical EPSS 0.29% |
< 4.14.2 | 4.14.2 |
| GHSA-82r6-8w77-94w6 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
Critical EPSS 0.29% |
< 4.14.2 | 4.14.2 |
| GHSA-82r6-8w77-94w6 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
Critical EPSS 0.29% |
< 4.14.2 | 4.14.2 |
| GHSA-5p39-cfhj-2xmp AnyIO process-pool workers can block indefinitely on undrained stderr |
Medium EPSS 0.16% |
< 4.14.2 | 4.14.2 |
| GHSA-5p39-cfhj-2xmp AnyIO process-pool workers can block indefinitely on undrained stderr |
Medium EPSS 0.16% |
< 4.14.2 | 4.14.2 |
| GHSA-5p39-cfhj-2xmp AnyIO process-pool workers can block indefinitely on undrained stderr |
Medium EPSS 0.16% |
< 4.14.2 | 4.14.2 |
| GHSA-3w57-8xmc-8v26 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups |
High EPSS 0.11% |
>= 4.14.0, < 4.14.2 | 4.14.2 |
| GHSA-3w57-8xmc-8v26 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups |
High EPSS 0.11% |
>= 4.14.0, < 4.14.2 | 4.14.2 |
| GHSA-3w57-8xmc-8v26 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups |
High EPSS 0.11% |
>= 4.14.0, < 4.14.2 | 4.14.2 |
Source: https://github.com/agronholm/anyio
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor