{"id":"GHSA-pph8-gcv7-4qj5","aliases":["RUSTSEC-2025-0020"],"status":"published","title":"PyO3 Risk of buffer overflow in `PyString::from_object`","description":"`PyString::from_object` took `\u0026str` arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the `\u0026str` data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).\n\nIn PyO3 0.24.1 this function will now allocate a `CString` to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternative API which takes `\u0026CStr` arguments.","severity":{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2025-04-01T12:00:00Z","modified":"2026-09-10T03:50:23Z","fixes":[{"ecosystem":"crates.io","package":"pyo3","fixed_in":["0.24.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"pyo3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.24.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"pyo3","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.24.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"pyo3","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.24.1"}]}]}],"references":[{"url":"https://github.com/PyO3/pyo3/issues/5005","tags":["web","report"]},{"url":"https://github.com/PyO3/pyo3/pull/5008","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0020.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pph8-gcv7-4qj5"},{"url":"https://github.com/PyO3/pyo3","tags":["package"]},{"url":"https://crates.io/crates/pyo3","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-pph8-gcv7-4qj5","title":"PyO3 Risk of buffer overflow in `PyString::from_object`","description":"`PyString::from_object` took `\u0026str` arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the `\u0026str` data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).\n\nIn PyO3 0.24.1 this function will now allocate a `CString` to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternative API which takes `\u0026CStr` arguments.","status":"published","published":"2025-04-02T13:19:19Z","modified":"2025-04-02T13:19:20Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"osv":[{"id":"GHSA-pph8-gcv7-4qj5","title":"PyO3 Risk of buffer overflow in `PyString::from_object`","description":"`PyString::from_object` took `\u0026str` arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the `\u0026str` data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).\n\nIn PyO3 0.24.1 this function will now allocate a `CString` to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternative API which takes `\u0026CStr` arguments.","status":"published","published":"2025-04-02T13:19:19Z","modified":"2026-09-10T03:50:23.976163491Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RUSTSEC-2025-0020","title":"Risk of buffer overflow in `PyString::from_object`","description":"`PyString::from_object` took `\u0026str` arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the `\u0026str` data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).\n\nIn PyO3 0.24.1 this function will now allocate a `CString` to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternative API which takes `\u0026CStr` arguments.","status":"published","published":"2025-04-01T12:00:00Z","modified":"2025-10-28T06:29:25.695525Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}