# CVE-2024-9979: RUSTSEC-2024-0378 - Risk of use-after-free in `borrowed` reads from Python weak references

Source: https://junglewise.ai/threats/cve-2024-9979-pyo3-has-a-risk-of-use-after-free-in-borrowed-reads-from-python  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-12  
License: CC BY 4.0 with a link back

CVE-2024-9979 · Severity: low · CVSS 3.1 · Published 2024-10-12

Risk of use-after-free in `borrowed` reads from Python weak references

Technologies: [pyo3 (crates.io)](https://junglewise.ai/threats/technologies/pyo3). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2024-9979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-9979 being exploited in the wild.

**How severe is CVE-2024-9979?** Low severity, with a CVSS score of 3.1, published 12 October 2024.

**Which products and versions are affected?** pyo3 (crates.io) SEMVER:introduced=0.22.0,fixed=0.22.4.

**Is there a fix for CVE-2024-9979?** Yes. pyo3 (crates.io): upgrade to 0.22.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2024-9979?** Check whether you run pyo3 (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyo3 (crates.io): upgrade to 0.22.4 or later

  ```sh
  cargo update -p pyo3
  ```


## Affected products

- pyo3 (crates.io) SEMVER:introduced=0.22.0,fixed=0.22.4

## Identifiers

- CVE-2024-9979
- GHSA-6jgw-rgmm-7cv6
- RUSTSEC-2024-0378

## Related threats

- [PyO3 missing Sync bound in PyCFunction new_closure](https://junglewise.ai/threats/pyo3-missing-sync-bound-in-pycfunction-new-closure-37dd6bc7)
- [PyO3 out-of-bounds read in list and tuple iterators](https://junglewise.ai/threats/pyo3-out-of-bounds-read-in-list-and-tuple-iterators-31441968)
- [RUSTSEC-2026-0177 - Missing `Sync` bound on `PyCFunction::new_closure` closures](https://junglewise.ai/threats/rustsec-2026-0177-missing-sync-bound-on-pycfunction-new-closure-e8081edc)
- [RUSTSEC-2026-0176 - Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators](https://junglewise.ai/threats/rustsec-2026-0176-out-of-bounds-read-in-nth-nth-back-for-pylist-and-f3042ce7)
- [PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature](https://junglewise.ai/threats/pyo3-has-type-confusion-when-accessing-data-from-sublasses-of-2db99dde)