Issues

compile: double free of pc->fail_pop in codegen_pattern_or on allocation failure with nested or-pattern

python/cpython#160789 · opened

on Oct 27, 2026

Use-after-free in `OSError.str` when a formatting callback clears `filename`

python/cpython#160773 · opened

on Oct 27, 2026

ctypes: out-of-bounds read/write in bool() and argument passing after resize()

python/cpython#160708 · opened

on Oct 26, 2026

sqlite3: concurrent execute() on a shared Connection crashes the process with a native access violation (threadsafety == 3)

python/cpython#160699 · opened

on Oct 26, 2026

1

Free-threaded build crashes when destructor ran in the middle of dict/list resize

python/cpython#160697 · opened

on Oct 26, 2026

UAF in GC `visit_generation()`

python/cpython#160663 · opened

on Oct 25, 2026

1

free-threaded: setiter_iternext releases the set once per racing thread

python/cpython#160573 · opened

on Oct 24, 2026

1

pyexpat: CPython can be crashed through resetting `StartDoctypeDeclHandler` with pyexpat at the wrong time

python/cpython#160442 · opened

on Oct 23, 2026

Concurrent mutation of cached slot names can crash default object state collection

python/cpython#160440 · opened

on Oct 23, 2026

Assertion `year >= 1' failed in 'days_before_year'` when unpickling datetime with year 0

python/cpython#160358 · opened

on Oct 22, 2026

5

`io.StringIO` crashes or returns garbage when used after a `MemoryError`

python/cpython#160324 · opened

on Oct 22, 2026

`re.Pattern.match()` matches and can read out of bounds when `pos > endpos`

python/cpython#160316 · opened

on Oct 22, 2026

Tachyon frame cache can write into freed thread-state memory

python/cpython#160267 · opened

on Oct 22, 2026

Crash in tkinter when passing a recursive or deeply nested list to Tcl

python/cpython#160176 · opened

on Oct 22, 2026

1

Python 3.14 crash randomly on AMD64 Debian root 3.14 buildbot (VM issue or hardware issue?)

python/cpython#159764 · opened

on Oct 19, 2026

18

Sharing a memoryview iterator across threads can abort free-threaded CPython

python/cpython#159760 · opened

on Oct 19, 2026

2

Segfault freeing a deeply nested list after creating a JVM on the main thread (3.14 regression)

python/cpython#159639 · opened

on Oct 17, 2026

8

Segfault on re-entrant lazy import pandas

python/cpython#159408 · opened

on Oct 14, 2026

1

PyObject_ClearManagedDict() loses the propagating exception on MemoryError

python/cpython#159283 · opened

on Oct 13, 2026

del StopIteration.value stores NULL in C field, crashing generators (SIGSEGV)

python/cpython#159090 · opened

on Oct 9, 2026

`push_cold_blocks_to_end()` does not check the return value of `basicblock_addop()`

python/cpython#159054 · opened

on Oct 9, 2026

bytearray.init slow-path append ignores ob_start leading to linear heap OOB write

python/cpython#158928 · opened

on Oct 6, 2026

_PyUnicode_EncodeUTF16 backward error-handler under-reserve leading to heap overflow

python/cpython#158925 · opened

on Oct 6, 2026

`_interpreters` `xibufferview_getbuf` missing INCREF: shared-memoryview UAF

python/cpython#158923 · opened

on Oct 6, 2026

_pickle crashes when read() returns a bytes subclass for large payloads

python/cpython#158841 · opened

on Oct 5, 2026

4

Navigation Menu

Repository navigation

Issues

compile: double free of pc->fail_pop in codegen_pattern_or on allocation failure with nested or-pattern

Use-after-free in `OSError.str` when a formatting callback clears `filename`

ctypes: out-of-bounds read/write in bool() and argument passing after resize()

sqlite3: concurrent execute() on a shared Connection crashes the process with a native access violation (threadsafety == 3)

Free-threaded build crashes when destructor ran in the middle of dict/list resize

UAF in GC `visit_generation()`

free-threaded: setiter_iternext releases the set once per racing thread

pyexpat: CPython can be crashed through resetting `StartDoctypeDeclHandler` with pyexpat at the wrong time

Concurrent mutation of cached slot names can crash default object state collection

Assertion `year >= 1' failed in 'days_before_year'` when unpickling datetime with year 0

`io.StringIO` crashes or returns garbage when used after a `MemoryError`

`re.Pattern.match()` matches and can read out of bounds when `pos > endpos`

Tachyon frame cache can write into freed thread-state memory

Crash in tkinter when passing a recursive or deeply nested list to Tcl

Python 3.14 crash randomly on AMD64 Debian root 3.14 buildbot (VM issue or hardware issue?)

Sharing a memoryview iterator across threads can abort free-threaded CPython

Segfault freeing a deeply nested list after creating a JVM on the main thread (3.14 regression)

Segfault on re-entrant lazy import pandas

PyObject_ClearManagedDict() loses the propagating exception on MemoryError

del StopIteration.value stores NULL in C field, crashing generators (SIGSEGV)

`push_cold_blocks_to_end()` does not check the return value of `basicblock_addop()`

bytearray.init slow-path append ignores ob_start leading to linear heap OOB write

_PyUnicode_EncodeUTF16 backward error-handler under-reserve leading to heap overflow

`_interpreters` `xibufferview_getbuf` missing INCREF: shared-memoryview UAF

_pickle crashes when read() returns a bytes subclass for large payloads