← Back to CVE List
CVE-2026-63374NVD
Vulnerability Summary
### Impact
Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker would obtain a legitimate certificate using the IDNA 2003 encoded version of the domain name and offer it to the connecting client, making the certificate validate properly on the client's end.
### Patches
The vulnerability will be patched in v4.14.2.
### Workarounds
Encode host names via the `idna` package prior to connecting.
Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker would obtain a legitimate certificate using the IDNA 2003 encoded version of the domain name and offer it to the connecting client, making the certificate validate properly on the client's end.
### Patches
The vulnerability will be patched in v4.14.2.
### Workarounds
Encode host names via the `idna` package prior to connecting.