RUSTSEC-2026-0176

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0176

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0176.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0176

Aliases

GHSA-36hh-v3qg-5jq4

Published

2026-06-11T12:00:00Z

Modified

2026-06-13T06:30:04Z

Summary

Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators

Details

PyO3 0.24.0 added optimized implementations of Iterator::nth and DoubleEndedIterator::nth_back for the BoundListIterator and BoundTupleIterator types. These implementations computed the target index using unchecked usize addition (index + n) before bounds-checking against the sequence length, then read the element via get_item_unchecked.

In nth methods, a sufficiently large n (combined with a non-zero internal index) could cause the addition to overflow and wrap around, producing a small "target index" that passed the bounds check and enabling reads at the front of the list or tuple of elements previously yielded by the iterator.

In nth_back methods, a sufficiently large n could cause underflow in a similar fashion, however would instead allow reads of arbitrary memory past the end of the list or tuple storage.

PyO3 0.29.0 has corrected these methods to use checked arithmetic at the positions which could be at risk of overflow.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / pyo3

Package

Name: pyo3; View open source insights on deps.dev
Purl: pkg:cargo/pyo3

Affected ranges

Type: SEMVER
Events: Introduced

0.24.0

Fixed

0.29.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "pyo3::types::list::BoundListIterator::nth",
            "pyo3::types::list::BoundListIterator::nth_back",
            "pyo3::types::tuple::BoundTupleIterator::nth",
            "pyo3::types::tuple::BoundTupleIterator::nth_back"
        ],
        "os": []
    }
}