Vulnerability LowRUSTSEC-2025-0020 · pyo3
RUSTSEC-2025-0020: Risk of buffer overflow in `PyString::from_object`
Short answerA security vulnerability in the pyo3 crate: Risk of buffer overflow in `PyString::from_object`. GitHub rates it Low. Fixed in 0.24.1: update to a fixed version.
| Crate | pyo3 |
|---|---|
| Type | Vulnerability (memory-exposure) |
| Affected versions | Before 0.24.1. |
| Fixed in | 0.24.1 |
| Severity | Low (GitHub rating) |
| Published | 2025-04-01 |
| Last changed | 2025-10-28 |
| Also known as | GHSA-pph8-gcv7-4qj5 |
| Affected functions | pyo3::types::PyString::from_object, pyo3::types::PyString::from_object_bound |
What to do
- See which version you have:
cargo tree -i pyo3(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p pyo3. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplepyo3 = "0.24.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
PyString::from_object took &str arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the &str data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).
In PyO3 0.24.1 this function will now allocate a CString to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternative API which takes &CStr arguments.
References
- Package: crates.io/crates/pyo3
- Advisory: rustsec.org/advisories/RUSTSEC-2025-0020.html
- Report: github.com/PyO3/pyo3/issues/5005
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for pyo3
- Vulnerability MediumRUSTSEC-2020-0074 · 2020-11-28Reference counting error in `From<Py<T>>`
- VulnerabilityRUSTSEC-2024-0378 · 2024-10-12Risk of use-after-free in `borrowed` reads from Python weak references
- VulnerabilityRUSTSEC-2024-0409 · 2024-12-04Build corruption when using `PYO3_CONFIG_FILE` environment variable
- VulnerabilityRUSTSEC-2026-0013 · 2026-02-18Type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature targeting Python 3.12 and up
- VulnerabilityRUSTSEC-2026-0176 · 2026-06-11Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
- VulnerabilityRUSTSEC-2026-0177 · 2026-06-11Missing `Sync` bound on `PyCFunction::new_closure` closures
Up next
Same cratepyo3: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?