Skip to content
OpenAdvisories

Package · crates.io

pyo3

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium —
    GHSA-chgr-c6px-7xpp

    PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures

    `PyCFunction::new_closure` (and the temporary `new_closure_bound` complement in the 0.21–0.22 series) required the supplied closure to be `Send + 'static` but not `Sync`. The resulting `PyCFunction` is a Python callable that can be invoked from any Python thr…

    pyo3 crates.io
  • Medium —
    GHSA-vxcf-c7mx-pg53

    Build corruption when using `PYO3_CONFIG_FILE` environment variable

    In PyO3 0.23.0 the `PYO3_CONFIG_FILE` environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as `maturin` to…

    pyo3 crates.io
  • Medium 5.3
    CVE-2024-9979

    Pyo3: risk of use-after-free in `borrowed` reads from python weak references

    A flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or crashes via unsound borrowing from weak Python references.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian crates.io
  • Medium 5.5
    CVE-2020-35917

    Reference counting error in pyo3

    An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>.

    pyo3 crates.io