Executive brief
AnyIO is an async I/O library used for concurrent task execution across multiple processes. The library's process-pool feature fails to properly drain the standard error stream in worker processes, allowing stderr buffers to fill up and block indefinitely. An attacker or faulty code that writes large amounts of data to stderr can cause the entire process pool to hang, resulting in service unavailability and denial of service.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) in AnyIO's process-pool worker initialization. AnyIO redirects stdin and stdout to /dev/null for protocol protection but fails to drain the stderr pipe despite documentation claiming all three standard streams are redirected. When untrusted code or a malicious actor writes sufficient data to stderr, the pipe buffer fills completely, causing the worker to block on subsequent stderr writes before it can return the stdout protocol response. This blocks the awaiting process-pool call indefinitely. Exploitation requires the ability to execute code in the process pool (low privilege requirement, local attack vector). The fix is available in version 4.14.2.
Affected products
- agronholm AnyIO < 4.14.2
Timeline
- 2026-07-07: disclosed
- 2026-09-18: advisory
- 2026-09-18: patched: Version 4.14.2 released