TI-2024-09262 Aliases CVE-2024-9979 GHSA-6jgw-rgmm-7cv6

Pyo3: risk of use-after-free in `borrowed` reads from python weak references

LOW 23CWE-416Published 2024-10-15 · Updated 2026-11-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or crashes via unsound borrowing from weak Python references.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00206 10th percentileScored 2026-11-07

Fix Partial pyo3: 0.22.4pyo3 (crates.io): 0.22.4Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	pyo3	0.22.0 to before 0.22.4	0.22.4	Patch available	CNA
Red Hat	Red Hat Ansible Automation Platform 2	—	—	Not affected	CNA
Red Hat	Red Hat Ansible Automation Platform 2	—	—	Not affected	CNA
Red Hat	Red Hat Enterprise Linux 10	—	—	No fix listed	CNA
Red Hat	Red Hat Enterprise Linux 8	—	—	Not affected	CNA
Red Hat	Red Hat Enterprise Linux 8	—	—	Not affected	CNA
Red Hat	Red Hat Enterprise Linux 9	—	—	Not affected	CNA
Red Hat	Red Hat Enterprise Linux 9	—	—	Not affected	CNA
—	pyo3 (crates.io)	0.22.0 to before 0.22.4	0.22.4	Patch available	GHSA-6jgw-rgmm-7cv6

pyo3 Vendor— Affected 0.22.0 to before 0.22.4 Fixed in 0.22.4 Patch available CNA
Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — Not affected CNA
Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — Not affected CNA
Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
pyo3 (crates.io) Vendor— Affected 0.22.0 to before 0.22.4 Fixed in 0.22.4 Patch available GHSA-6jgw-rgmm-7cv6

CPE names CNA · 4

CPE	Versions	Role	Vendor
cpe:/a:redhat:ansible_automation_platform:2	2	—	Red Hat
cpe:/a:redhat:enterprise_linux:10	10	—	Red Hat
cpe:/a:redhat:enterprise_linux:8	8	—	Red Hat
cpe:/a:redhat:enterprise_linux:9	9	—	Red Hat

cpe:/a:redhat:ansible_automation_platform:2 Versions 2 — ·Red Hat
cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
cpe:/a:redhat:enterprise_linux:9 Versions 9 — ·Red Hat

Remediation

Fix · CNA pyo3 Fixed in 0.22.4
Fix · GHSA-6jgw-rgmm-7cv6 pyo3 (crates.io) Fixed in 0.22.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix planned: Will not fix

Not affected: 3 products

Red Hat Ansible Automation Platform 2
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2024-9979
2026-10-03 Alias added: GHSA-6jgw-rgmm-7cv6

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-9979

Other 6

TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8

See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences