AIKIDO-2026-889297

TL;DR

TLSStream.wrap() in anyio resolves internationalized hostnames using IDNA 2003 instead of IDNA 2008. Because the two standards map some Unicode labels to different ASCII encodings, the hostname passed to wrap_bio for certificate validation can differ from the hostname the caller intended. A TLS certificate issued for the IDNA 2008 encoding of a hostname can therefore fail validation against an IDNA 2003-encoded peer, and conversely a certificate for a different host under the IDNA 2003 mapping may be accepted as valid. The fix introduces idna2008_resolve() and uses the corrected server_hostname in wrap_bio.