CVE-2026-63349: CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module

CVE-2026-63349 represents a critical vulnerability in the AnyIO asynchronous framework versions 4.14.0 and 4.14.1 that run on POSIX platforms. The flaw stems from a variable assignment typo, causing supplementary groups provided by developers to fail in proper propagation to the execution backend. This oversight leads to subprocesses retaining the parent process's elevated supplementary group permissions, effectively bypassing security boundaries.

Such a vulnerability can enable privilege escalation and potentially lead to a denial-of-service scenario. The CVSS score for this security flaw is 7.0, categorizing it as high-risk. The vulnerability is classified under CWE-266 (Privilege Reduction) and CWE-269 (Improper Privilege Management). It only affects subprocesses within AnyIO, not the main process. AnyIO 4.14.2 contains a fix for this issue, as the typo causing the problem has been corrected.