Skip to content
Fencer Intel
low —

GHSA-pph8-gcv7-4qj5 json

PyO3 Risk of buffer overflow in `PyString::from_object`

published last yr. modified 2mo ago also RUSTSEC-2025-0020

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

`PyString::from_object` took `&str` arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the `&str` data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).

In PyO3 0.24.1 this function will now allocate a `CString` to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternative API which takes `&CStr` arguments.

Patch / fix

  • crates.io pyo3 0.24.1

Is GHSA-pph8-gcv7-4qj5 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io pyo3
>=0.1.0, <0.24.1
>=0.0.0-0, <0.24.1
0.24.1

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.