RUSTSEC-2026-0176: Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators

What to do

1. See which version you have: cargo tree -i pyo3 (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p pyo3. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example pyo3 = "0.29.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

PyO3 0.24.0 added optimized implementations of Iterator::nth and DoubleEndedIterator::nth_back for the BoundListIterator and BoundTupleIterator types. These implementations computed the target index using unchecked usize addition (index + n) before bounds-checking against the sequence length, then read the element via get_item_unchecked.

In nth methods, a sufficiently large n (combined with a non-zero internal index) could cause the addition to overflow and wrap around, producing a small "target index" that passed the bounds check and enabling reads at the front of the list or tuple of elements previously yielded by the iterator.

In nth_back methods, a sufficiently large n could cause underflow in a similar fashion, however would instead allow reads of arbitrary memory past the end of the list or tuple storage.

PyO3 0.29.0 has corrected these methods to use checked arithmetic at the positions which could be at risk of overflow.

References

• Package: crates.io/crates/pyo3
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0176.html
• Web: github.com/PyO3/pyo3/pull/6086

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for pyo3

• Vulnerability MediumRUSTSEC-2020-0074 · 2020-11-28Reference counting error in `From<Py<T>>`
• VulnerabilityRUSTSEC-2024-0378 · 2024-10-12Risk of use-after-free in `borrowed` reads from Python weak references
• VulnerabilityRUSTSEC-2024-0409 · 2024-12-04Build corruption when using `PYO3_CONFIG_FILE` environment variable
• VulnerabilityRUSTSEC-2025-0020 · 2025-04-01Risk of buffer overflow in `PyString::from_object`
• VulnerabilityRUSTSEC-2026-0013 · 2026-02-18Type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature targeting Python 3.12 and up
• VulnerabilityRUSTSEC-2026-0177 · 2026-06-11Missing `Sync` bound on `PyCFunction::new_closure` closures

Full security history of pyo3