GHSA-5p39-cfhj-2xmp AnyIO process-pool workers can block indefinitely on undrained stderr

• PyPI anyio: < 4.14.2 → fixed in 4.14.2

Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call. Anyone who runs untrusted or faulty code that writes too much to `stderr` is at risk. Patches This vulnerability will be patched in v4.14.2. Workarounds Closing `sys.stderr` in the target function should at least prevent the deadlock.