Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-63374
By Peleg Lampl |
20 September 2026
CVE-2026-63374 – AnyIO IDNA hostname handling flaw enables TLS certificate validation bypass
AnyIO connect_tcp()/TLSStream.wrap() can validate the wrong TLS identity for internationalized (non-ASCII) domains when a hijacked connection is redirected to an attacker server presenting a cert for the IDNA 2003-encoded hostname. Affects `pip/anyio