Executive brief
AnyIO is a Python library for asynchronous network I/O. When applications connect to internationalized domain names (non-ASCII characters), AnyIO improperly validates TLS certificates using outdated IDNA 2003 encoding instead of modern standards. An attacker who redirects network traffic can present a valid certificate for the IDNA-encoded domain name, causing the client to accept a spoofed connection. This allows attackers to intercept encrypted communication and steal sensitive data like credentials or session tokens.
Technical details
The vulnerability exists in AnyIO's `connect_tcp()` and `TLSStream.wrap()` methods, which use IDNA 2003 encoding for internationalized domain names during TLS certificate validation. This creates a mismatch between the hostname the user intends to connect to and the hostname validated against the certificate. An attacker who achieves network-level hijacking (e.g., via DNS spoofing, ARP poisoning, or BGP hijacking) can obtain a legitimate TLS certificate for the IDNA 2003-encoded version of the domain and present it during the handshake. The client will validate the certificate as correct due to the encoding mismatch, allowing the attacker to perform man-in-the-middle attacks. The attack requires network-level access but no privileges or user interaction. The vulnerability affects versions prior to 4.14.2, which implements the fix.
Affected products
- agronholm AnyIO < 4.14.2
Timeline
- 2026-07-07: disclosed
- 2026-09-18: advisory
- 2026-09-18: patched: patched in v4.14.2