# CVE-2020-35917: RUSTSEC-2020-0074 - Reference counting error in `From<Py<T>>`

Source: https://junglewise.ai/threats/cve-2020-35917-reference-counting-error-in-pyo3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-11-28  
License: CC BY 4.0 with a link back

CVE-2020-35917 · Severity: low · CVSS 3.1 · Published 2020-11-28

Reference counting error in `From<Py<T>>`

Technologies: [pyo3 (crates.io)](https://junglewise.ai/threats/technologies/pyo3). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2020-35917 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-35917 being exploited in the wild.

**How severe is CVE-2020-35917?** Low severity, with a CVSS score of 3.1, published 28 November 2020.

**Which products and versions are affected?** pyo3 (crates.io) SEMVER:introduced=0.12.0,fixed=0.12.4.

**Is there a fix for CVE-2020-35917?** Yes. pyo3 (crates.io): upgrade to 0.12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2020-35917?** Check whether you run pyo3 (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyo3 (crates.io): upgrade to 0.12.4 or later

  ```sh
  cargo update -p pyo3
  ```


## Affected products

- pyo3 (crates.io) SEMVER:introduced=0.12.0,fixed=0.12.4

## Identifiers

- CVE-2020-35917
- GHSA-2vx6-fcw6-hpr6
- RUSTSEC-2020-0074

## Related threats

- [PyO3 missing Sync bound in PyCFunction new_closure](https://junglewise.ai/threats/pyo3-missing-sync-bound-in-pycfunction-new-closure-37dd6bc7)
- [PyO3 out-of-bounds read in list and tuple iterators](https://junglewise.ai/threats/pyo3-out-of-bounds-read-in-list-and-tuple-iterators-31441968)
- [RUSTSEC-2026-0177 - Missing `Sync` bound on `PyCFunction::new_closure` closures](https://junglewise.ai/threats/rustsec-2026-0177-missing-sync-bound-on-pycfunction-new-closure-e8081edc)
- [RUSTSEC-2026-0176 - Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators](https://junglewise.ai/threats/rustsec-2026-0176-out-of-bounds-read-in-nth-nth-back-for-pylist-and-f3042ce7)
- [PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature](https://junglewise.ai/threats/pyo3-has-type-confusion-when-accessing-data-from-sublasses-of-2db99dde)