Vulnerability MediumRUSTSEC-2024-0378 · pyo3
RUSTSEC-2024-0378: Risk of use-after-free in `borrowed` reads from Python weak references
Short answerA security vulnerability in the pyo3 crate: Risk of use-after-free in `borrowed` reads from Python weak references. GitHub rates it Medium. Fixed in 0.22.4: update to a fixed version.
| Crate | pyo3 |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | From 0.22.0 before 0.22.4. |
| Fixed in | 0.22.4 |
| Severity | Medium (GitHub rating) |
| Published | 2024-10-12 |
| Last changed | 2025-10-28 |
| Also known as | CVE-2024-9979, GHSA-6jgw-rgmm-7cv6 |
| Affected functions | pyo3::types::PyWeakrefMethods::get_object_borrowed, pyo3::types::PyWeakrefMethods::upgrade_borrowed, pyo3::types::PyWeakrefMethods::upgrade_borrowed_as, pyo3::types::PyWeakrefMethods::upgrade_borrowed_as_exact, pyo3::types::PyWeakrefMethods::upgrade_borrowed_as_unchecked |
What to do
- See which version you have:
cargo tree -i pyo3(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p pyo3. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplepyo3 = "0.22.4") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The family of functions to read "borrowed" values from Python weak references were fundamentally unsound, because the weak reference does itself not have ownership of the value. At any point the last strong reference could be cleared and the borrowed value would become dangling.
In PyO3 0.22.4 these functions have all been deprecated and patched to leak a strong reference as a mitigation. PyO3 0.23 will remove these functions entirely.
References
- Package: crates.io/crates/pyo3
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0378.html
- Web: github.com/PyO3/pyo3/pull/4590
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for pyo3
- Vulnerability MediumRUSTSEC-2020-0074 · 2020-11-28Reference counting error in `From<Py<T>>`
- VulnerabilityRUSTSEC-2024-0409 · 2024-12-04Build corruption when using `PYO3_CONFIG_FILE` environment variable
- VulnerabilityRUSTSEC-2025-0020 · 2025-04-01Risk of buffer overflow in `PyString::from_object`
- VulnerabilityRUSTSEC-2026-0013 · 2026-02-18Type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature targeting Python 3.12 and up
- VulnerabilityRUSTSEC-2026-0176 · 2026-06-11Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
- VulnerabilityRUSTSEC-2026-0177 · 2026-06-11Missing `Sync` bound on `PyCFunction::new_closure` closures
Up next
Same cratepyo3: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?