CPython 3.13-3.15 concurrency and memory-safety issue reports

[BaihongChen]

Hello!

We are a team conducting Python security research. Recently, we investigated concurrency behavior in CPython and identified a set of reproducible correctness, concurrency, and memory-safety issues.

We evaluated free-threaded (FT) and conventional GIL-enabled builds separately. The confirmed findings cover CPython 3.13, 3.14, and 3.15. Across both build modes and releases, we identified 142 unique bugs in total.

Of these, 139 were confirmed in free-threaded builds and 34 were confirmed in conventional GIL-enabled builds. These two groups overlap: 31 bugs were confirmed in both build modes, while 3 were confirmed only in GIL-enabled builds.

The findings affect 29 library or extension components, 61 logical components, and 75 C source files. They primarily include Race Condition (CWE-362), TOCTOU Race Condition (CWE-367), Use After Free (CWE-416), and Improper Control of a Resource Through its Lifetime (CWE-664).

We have prepared a GitHub repository containing detailed bug reports, PoCs, and a comprehensive summary:

https://github.com/BaihongChen/cpython-concurrency-bugs

Complete component coverage

Component	Category	3.13	3.14	3.15
_remote_debugging	Library/extension	—	—	✓
array	Library/extension	✓	✓	✓
asyncio	Library/extension	✓	—	—
atexit	Library/extension	✓	—	—
collections	Library/extension	✓	✓	✓
compression.zstd	Library/extension	—	✓	✓
csv	Library/extension	✓	—	—
ctypes	Library/extension	✓	✓	✓
curses	Library/extension	—	✓	—
decimal	Library/extension	✓	✓	—
_suggestions / error suggestions	Library/extension	✓	✓	—
functools	Library/extension	✓	✓	✓
io	Library/extension	✓	✓	—
itertools	Library/extension	✓	✓	✓
json	Library/extension	✓	✓	—
locale	Library/extension	—	✓	—
multibyte codecs	Library/extension	✓	✓	✓
os	Library/extension	✓	✓	✓
pickle	Library/extension	✓	✓	✓
pyexpat	Library/extension	✓	✓	✓
re	Library/extension	✓	✓	✓
select	Library/extension	✓	✓	✓
sqlite3	Library/extension	✓	✓	✓
ssl	Library/extension	✓	✓	✓
struct	Library/extension	✓	✓	✓
subprocess	Library/extension	✓	✓	✓
syslog	Library/extension	✓	✓	✓
termios	Library/extension	✓	✓	✓
tkinter	Library/extension	✓	✓	✓
xml.etree.ElementTree	Library/extension	✓	✓	✓
bytearray	Built-in/core	✓	✓	✓
bytes	Built-in/core	✓	✓	✓
call protocol	Built-in/core	✓	✓	✓
collections.OrderedDict	Built-in/core	✓	✓	✓
dict	Built-in/core	✓	✓	✓
exceptions	Built-in/core	✓	✓	✓
float	Built-in/core	✓	✓	✓
frame	Built-in/core	✓	✓	✓
function	Built-in/core	✓	✓	✓
generator	Built-in/core	—	✓	—
int	Built-in/core	✓	✓	✓
memoryview	Built-in/core	✓	✓	✓
module	Built-in/core	✓	✓	✓
object protocol	Built-in/core	✓	✓	✓
str	Built-in/core	✓	✓	✓
struct sequence	Built-in/core	✓	✓	✓
type	Built-in/core	✓	✓	—
ast	Runtime/compiler	✓	✓	✓
C argument parsing	Runtime/compiler	✓	✓	✓
codec registry	Runtime/compiler	✓	✓	✓
compile/exec	Runtime/compiler	✓	✓	✓
compiler/evaluator	Runtime/compiler	✓	✓	✓
contextvars	Runtime/compiler	✓	✓	✓
cross-interpreter data	Runtime/compiler	✓	✓	✓
garbage collection	Runtime/compiler	✓	✓	✓
import machinery	Runtime/compiler	✓	✓	✓
marshal	Runtime/compiler	✓	✓	✓
PyConfig	Runtime/compiler	✓	✓	✓
runtime finalization	Runtime/compiler	✓	✓	✓
sys	Runtime/compiler	✓	✓	✓
traceback	Runtime/compiler	✓	✓	✓
warnings	Runtime/compiler	✓	—	—

We hope these issues can be further confirmed and fixed in future releases. Thank you!

[hugovk]

Dumping a mass report of 142 bugs isn't very helpful, and difficult for us to process. As you can se, we already have 6,921 open issues and 2,638 open PRs in our backlog.

Please can you check these really are "unique" and not duplicates of existing reports?

For example, I've not verified, but an LLM suggests the 8 memoryview for 3.14 reports all describe the same defect that gh-127716 (opened Dec 2024) tracks and will be fixed by #156248 (opened Aug 2026), currently under review.

Also two of the csv reports for 3.13 was already fixed in #141365 in Nov 2025 and backported to 3.14. The choice not to backport to 3.13 was likely deliberate, as free-threaded support is experimental in 3.13.

It would be more helpful if you can pick a much smaller set (3-5?) of the most important reports, verify they're not duplicates, and evaluate whether they're worth fixing.

[BaihongChen]

We further screened the findings and checked existing CPython issues. We selected the following five issues that meet the requested criteria. Each affects CPython 3.14 and 3.15, affects both free-threaded and GIL-enabled builds, and belongs to Built-in/core or Runtime/compiler:

1. compile(bytearray) source-storage UAF
   An audit hook can release source storage that the compiler is still using, causing a deterministic heap-use-after-free.

2. int(bytearray) storage UAF
   A module import during large-integer conversion can invalidate the raw bytearray pointer, causing a heap-use-after-free.

3. PyImport_GetImporter() path-hook UAF
   This Stable ABI function can continue using a freed sys.path_hooks entry during the call.

4. Module-finalization stderr reentry
   A sys.__stderr__ callback can remove sys.modules entries that the finalization path still holds as borrowed references, causing a memory-safety failure.

5. PyFunction_GetAnnotations() synchronization race
   The public C API lacks function-object synchronization. It can cause native failures in free-threaded builds and overwrite a completed annotations update in GIL-enabled builds. This differs from python/cpython#128714, which addressed the Python-level attribute getter rather than this public C API path.

We believe these five issues all have concrete PoCs, verifiable impact, and clear value in being fixed.