Vulnerability HighRUSTSEC-2026-0013 · pyo3
RUSTSEC-2026-0013: Type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature targeting Python 3.12 and up
Short answerA security vulnerability in the pyo3 crate: Type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature targeting Python 3.12 and up. GitHub rates it High. Fixed in 0.28.2: update to a fixed version.
| Crate | pyo3 |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | From 0.28.0 before 0.28.2. |
| Fixed in | 0.28.2 |
| Severity | High (GitHub rating) |
| Published | 2026-02-18 |
| Last changed | 2026-02-23 |
| Also known as | GHSA-47qc-857f-7w7f |
What to do
- See which version you have:
cargo tree -i pyo3(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p pyo3. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplepyo3 = "0.28.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
PyO3 0.28.1 added support for #[pyclass(extends=PyList)] struct NativeSub (and other native types) when targeting Python 3.12 and up with the abi3 feature.
It was discovered that subclasses of such classes would use the type of the subclass when attempting to access to data of NativeSub contained within Python objects, amounting to memory corruption.
PyO3 0.28.2 fixed the issue by using the type of (e.g.) NativeSub correctly.
References
- Package: crates.io/crates/pyo3
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0013.html
- Web: github.com/PyO3/pyo3/pull/5807#issuecomment-3913251784
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for pyo3
- Vulnerability MediumRUSTSEC-2020-0074 · 2020-11-28Reference counting error in `From<Py<T>>`
- VulnerabilityRUSTSEC-2024-0378 · 2024-10-12Risk of use-after-free in `borrowed` reads from Python weak references
- VulnerabilityRUSTSEC-2024-0409 · 2024-12-04Build corruption when using `PYO3_CONFIG_FILE` environment variable
- VulnerabilityRUSTSEC-2025-0020 · 2025-04-01Risk of buffer overflow in `PyString::from_object`
- VulnerabilityRUSTSEC-2026-0176 · 2026-06-11Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
- VulnerabilityRUSTSEC-2026-0177 · 2026-06-11Missing `Sync` bound on `PyCFunction::new_closure` closures
Up next
Same cratepyo3: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?