Vulnerability MediumRUSTSEC-2024-0409 · pyo3
RUSTSEC-2024-0409: Build corruption when using `PYO3_CONFIG_FILE` environment variable
Short answerA security vulnerability in the pyo3 crate: Build corruption when using `PYO3_CONFIG_FILE` environment variable. GitHub rates it Medium. Fixed in 0.23.3: update to a fixed version.
| Crate | pyo3 |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | From 0.23.0 before 0.23.3. |
| Fixed in | 0.23.3 |
| Severity | Medium (GitHub rating) |
| Published | 2024-12-04 |
| Last changed | 2025-10-28 |
| Also known as | GHSA-vxcf-c7mx-pg53 |
What to do
- See which version you have:
cargo tree -i pyo3(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p pyo3. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplepyo3 = "0.23.3") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
In PyO3 0.23.0 the PYO3_CONFIG_FILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single build, this leads to Python wheels being compiled against the wrong Python API version.
All users who distribute artefacts for multiple Python versions are encouraged to update and rebuild with PyO3 0.23.3. Affected wheels produced from PyO3 0.23.0 through 0.23.2 are highly unstable and will crash the Python interpreter in unpredictable ways.
References
- Package: crates.io/crates/pyo3
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0409.html
- Report: github.com/PyO3/pyo3/issues/4757
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for pyo3
- Vulnerability MediumRUSTSEC-2020-0074 · 2020-11-28Reference counting error in `From<Py<T>>`
- VulnerabilityRUSTSEC-2024-0378 · 2024-10-12Risk of use-after-free in `borrowed` reads from Python weak references
- VulnerabilityRUSTSEC-2025-0020 · 2025-04-01Risk of buffer overflow in `PyString::from_object`
- VulnerabilityRUSTSEC-2026-0013 · 2026-02-18Type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature targeting Python 3.12 and up
- VulnerabilityRUSTSEC-2026-0176 · 2026-06-11Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
- VulnerabilityRUSTSEC-2026-0177 · 2026-06-11Missing `Sync` bound on `PyCFunction::new_closure` closures
Up next
Same cratepyo3: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?