RUSTSEC-2023-0076
`cpython` is unmaintained
The cpython crate and the underlying python3-sys and python27-sys crates have been marked as no longer actively maintained by the developer.
There are also open issues for unsound code that is currently in these crates:
- cpython#265: Using some string functions causes segmentation faults on big-endian architectures. Due to incorrect bitfield manipulations, it is possible to create invalid Python objects that crash the Python interpreter.
- cpython#294: Python 3.12 is not supported. Due to ABI changes in Python 3.12, calling some string functions will result in invalid Python objects and / or cause out-of-bounds memory accesses.
Recommended alternatives
pyo3(version 0.19.2 and newer)
The pyo3 crate is actively maintained. Preliminary support for Python 3.12 was added in version 0.19.2, and version 0.20.0 was released with full support for Python 3.12.
Both versions implement string functions correctly on big-endian architectures. The endianness issue affecting the cpython crate was fixed in recent versions of pyo3.
What each source reports
OSV No score
`cpython` is unmaintained
The cpython crate and the underlying python3-sys and python27-sys crates have been marked as no longer actively maintained by the developer.
There are also open issues for unsound code that is currently in these crates:
- cpython#265: Using some string functions causes segmentation faults on big-endian architectures. Due to incorrect bitfield manipulations, it is possible to create invalid Python objects that crash the Python interpreter.
- cpython#294: Python 3.12 is not supported. Due to ABI changes in Python 3.12, calling some string functions will result in invalid Python objects and / or cause out-of-bounds memory accesses.
Recommended alternatives
pyo3(version 0.19.2 and newer)
The pyo3 crate is actively maintained. Preliminary support for Python 3.12 was added in version 0.19.2, and version 0.20.0 was released with full support for Python 3.12.
Both versions implement string functions correctly on big-endian architectures. The endianness issue affecting the cpython crate was fixed in recent versions of pyo3.
- Record
RUSTSEC-2023-0076- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cpythoncrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2023-0076 is a vulnerability with no CVSS score yet in cpython, published November 14, 2023. No source lists public exploit code. No source names a fixed version.