Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-64847, describes a deadlock scenario in AnyIO's process-pool workers due to an undrained stderr pipe. The core issue is that while stdin and stdout were redirected to /dev/null in worker processes, stderr was not. This allowed a worker process writing a large amount of data to stderr to fill the pipe buffer, causing it to block indefinitely and leading to a deadlock in the calling process.
The provided commit f1b7301c8264b0d2e8d24a5788fd29e93dea4040 directly addresses this issue. The patch modifies src/anyio/to_process.py, specifically within the process_worker function. The change + sys.stderr = open(os.devnull, "w") clearly shows the addition of stderr redirection to /dev/null. This confirms that process_worker was the function responsible for setting up the standard streams for the worker process and, prior to the patch, was missing the crucial stderr redirection.
Therefore, to_process.process_worker is identified as the vulnerable function because its incomplete handling of standard stream redirection created the condition for the deadlock. When the vulnerability is exploited (i.e., a worker writes excessive data to stderr), this function would be active in the worker process's setup phase, and its lack of stderr redirection is the root cause of the resource exhaustion leading to the block.
to_process.process_workersrc/anyio/to_process.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| anyio | pip | < 4.14.2 | 4.14.2 |