Executive brief
PyO3, a library used to bridge Rust and Python code, contains a thread-safety flaw in how it handles certain background functions (closures). Because these functions were not properly restricted to safe concurrent use, multiple parts of a program could attempt to modify the same data simultaneously. This can lead to unpredictable behavior, data corruption, or crashes, especially in high-performance or multi-threaded Python environments.
Technical details
The vulnerability stems from a missing 'Sync' trait bound on the closures passed to PyCFunction::new_closure and PyCFunction::new_closure_bound. While the API enforced 'Send + static', the lack of 'Sync' allows a closure to be invoked concurrently from multiple Python threads without proper synchronization. This is particularly critical in free-threaded Python environments (no GIL) or when using 'Python::detach' in GIL-enabled environments, as it allows interleaved or parallel execution of the closure's logic. An attacker or a specific execution flow could trigger a data race, leading to undefined behavior or memory corruption. The issue is resolved in PyO3 version 0.29.0 by adding the necessary 'Sync' bound.
Affected products
- PyO3 pyo3 >= 0.15.0, < 0.29.0
Timeline
- 2026-06-02: other: Vulnerability discovered and pull request created
- 2026-06-04: patched: Fix merged into main branch
- 2026-06-11: disclosed: Vulnerability disclosed in RustSec and PyO3 0.29.0 release notes
- 2026-06-12: advisory: GitHub Advisory published