crates.io Package Vulnerabilities
Vulnerabilities associated with pyo3.
Packages
Clear package- surrealdb52 vulnerabilities
- wasmtime39 vulnerabilities
- deno37 vulnerabilities
- zebrad27 vulnerabilities
- openssl-src26 vulnerabilities
- ckb22 vulnerabilities
- coreutils21 vulnerabilities
- openssl18 vulnerabilities
- rusqlite16 vulnerabilities
- russh15 vulnerabilities
- apollo-router13 vulnerabilities
- rustfs13 vulnerabilities
- tough10 vulnerabilities
- cargo8 vulnerabilities
- gix8 vulnerabilities
- surrealdb-core8 vulnerabilities
- gitoxide7 vulnerabilities
- hyper7 vulnerabilities
- pyo37 vulnerabilities
- routinator7 vulnerabilities
- vaultwarden7 vulnerabilities
- Simple-Wayland-HotKey-Daemon6 vulnerabilities
- astral-tokio-tar6 vulnerabilities
- cranelift-codegen6 vulnerabilities
- deno_runtime6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures`PyCFunction::new_closure` (and the temporary `new_closure_bound` complement in the 0.21–0.22 series) required the supplied closure to be `Send + 'static` but not `Sync`. The resulting `PyCFunction` is a Python callable that can be invoked from any Python thread, which means the closure may be called concurrently from multiple threads, and needs a `Sync` bound to prevent possible data races. The problem exists under all Python versions but is particularly vulnerable under the newer free-threade… CWE-362Jun 12, 2026 | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iteratorsPyO3 0.24.0 added optimized implementations of `Iterator::nth` and `DoubleEndedIterator::nth_back` for the `BoundListIterator` and `BoundTupleIterator` types. These implementations computed the target index using unchecked `usize` addition (`index + n`) before bounds-checking against the sequence length, then read the element via `get_item_unchecked`. In `nth` methods, a sufficiently large `n` (combined with a non-zero internal index) could cause the addition to overflow and wrap around, produc… CWE-125Jun 12, 2026 | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` featurePyO3 0.28.1 added support for `#[pyclass(extends=PyList)] struct NativeSub` (and other native types) when targeting Python 3.12 and up with the `abi3` feature. It was discovered that subclasses of such classes would use the type of the subclass when attempting to access to data of `NativeSub` contained within Python objects, amounting to memory corruption. PyO3 0.28.2 fixed the issue by using the type of (e.g.) `NativeSub` correctly. CWE-843Feb 19, 2026 | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
PyO3 Risk of buffer overflow in `PyString::from_object``PyString::from_object` took `&str` arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the `&str` data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow). In PyO3 0.24.1 this function will now allocate a `CString` to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternativ… CWE-125Apr 2, 2025 | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Build corruption when using `PYO3_CONFIG_FILE` environment variableIn PyO3 0.23.0 the `PYO3_CONFIG_FILE` environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as `maturin` to build for multiple versions in a single build, this leads to Python wheels being compiled against the wrong Python API version. All users who distribute artefacts for multiple Python versions are encouraged to update and rebuild with PyO3 … Dec 5, 2024 | CVSS- | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Pyo3: risk of use-after-free in `borrowed` reads from python weak referencesA flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or crashes via unsound borrowing from weak Python references. CWE-416Oct 15, 2024 | CVSS-v4.0 | EPSS0.206% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2020-35917MEDIUM | Reference counting error in pyo3An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>. CWE-416Dec 31, 2020 | CVSS5.5v3.1 | EPSS0.388% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |