Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.3, published 12 June 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-06-04: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run pyo3 (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

PyO3 missing Sync bound in PyCFunction new_closure

Severity: medium · CVSS 6.3 · Published 2026-06-12

PyO3, a library used to bridge Rust and Python code, contains a thread-safety flaw in how it handles certain background functions (closures). Because these functions were not properly restricted to safe concurrent use, multiple parts of a program could attempt to modify the same data simultaneously. This can lead to unpredictable behavior, data corruption, or crashes, especially in high-performance or multi-threaded Python environments.

Technologies: pyo3 (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.3, published 12 June 2026.
Which products and versions are affected?: pyo3 (crates.io) < 0.29.0.
Is there a fix for This vulnerability?: A patch was published on 2026-06-04: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run pyo3 (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from a missing 'Sync' trait bound on the closures passed to PyCFunction::new_closure and PyCFunction::new_closure_bound. While the API enforced 'Send + static', the lack of 'Sync' allows a closure to be invoked concurrently from multiple Python threads without proper synchronization. This is particularly critical in free-threaded Python environments (no GIL) or when using 'Python::detach' in GIL-enabled environments, as it allows interleaved or parallel execution of the closure's logic. An attacker or a specific execution flow could trigger a data race, leading to undefined behavior or memory corruption. The issue is resolved in PyO3 version 0.29.0 by adding the necessary 'Sync' bound.

Affected products

PyO3 pyo3 >= 0.15.0, < 0.29.0

Timeline

2026-06-02: other: Vulnerability discovered and pull request created
2026-06-04: patched: Fix merged into main branch
2026-06-11: disclosed: Vulnerability disclosed in RustSec and PyO3 0.29.0 release notes
2026-06-12: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.