Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| anyio | pip | < 4.14.2 | 4.14.2 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-63374 in AnyIO is caused by the incorrect handling of internationalized domain names (IDNs) during TLS certificate validation. Specifically, the library was using the outdated IDNA 2003 standard for encoding hostnames, which can lead to different interpretations of domain names compared to the more secure and current IDNA 2008 standard. This discrepancy allows an attacker to obtain a legitimate certificate for an IDNA 2003 encoded version of a domain and use it to spoof a TLS connection.
The provided patch (commit 68f58915f82d9be8109ebbbd8f5d70577d43f2ce) addresses this by introducing a new helper function, idna2008_resolve, which correctly encodes hostnames using the IDNA 2008 standard. This function is then integrated into the core components responsible for establishing TLS connections:
connect_tcp in src/anyio/_core/_sockets.py: This function is a primary entry point for establishing TCP connections, including those that will be upgraded to TLS. The original implementation contained logic for encoding hostnames that was susceptible to the IDNA 2003 issue. The patch replaces this with a call to idna2008_resolve, indicating that the previous encoding mechanism within connect_tcp was vulnerable.
TLSStream.wrap in src/anyio/streams/tls.py: This method is directly involved in the TLS handshake process, specifically in preparing the server_hostname for certificate validation. Before the fix, it passed the raw hostname to the underlying ssl_context.wrap_bio function, which would then perform an IDNA 2003-based encoding. The patch explicitly pre-encodes the hostname using idna2008_resolve before passing it to wrap_bio, thereby preventing the vulnerability. This function is a direct point of failure for correct TLS hostname validation.
An attacker exploiting this vulnerability would provide an internationalized domain name that, when encoded with IDNA 2003, resolves to a different ASCII string than when encoded with IDNA 2008. By obtaining a certificate for the IDNA 2003 version, they could trick a vulnerable AnyIO client into validating a malicious server's certificate. Both and are critical functions in the call stack that would process the hostname and contribute to the vulnerable behavior during the TLS connection setup.
connect_tcpTLSStream.wrapconnect_tcpsrc/anyio/_core/_sockets.py
TLSStream.wrapsrc/anyio/streams/tls.py