René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CPython 3.13: consolidated memory-safety and concurrency bugs","articleBody":"Hello,\n\nThis issue consolidates 25 reproducible CPython 3.13 bugs involving memory safety and concurrency.\n\nThe bugs resulted from Python security research using static analysis. Each entry has a concrete PoC in the linked version-specific Gist. Although the collection is large, these bugs warrant inspection, especially the cases producing interpreter crashes, sanitizer failures, memory corruption, or similarly concrete failures.\n\nThis issue is associated with https://github.com/python/cpython/issues/157197 and https://github.com/python/cpython/issues/157198\n\n## Bugs\n\n1. [`asyncio` Future callback registry race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-001-asyncio-future-callback-registry-race-md) — Concurrent callback registration or removal can retire an unlocked callback-list item before `remove_done_callback()` promotes it, producing an ASan crash.\n2. [Unlocked `atexit` callback array](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-002-atexit-python-callback-array-unlocked-md) — Concurrent registry operations can use stale callback records and crash, while re-entrant comparison can delete an unrelated replacement callback.\n3. [`BaseException.__setstate__()` shared-dictionary race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-003-baseexception-setstate-shared-dict-race-md) — Concurrent value replacement can reclaim a dictionary entry between `PyDict_Next()` and reference promotion.\n4. [Bytearray methods using unlocked shared storage](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-004-bytearray-methods-unlocked-shared-storage-md) — Concurrent storage replacement causes out-of-bounds reads and mixed-generation results across several bytearray operations.\n5. [`bytes()` conversion of a shared list](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-005-bytes-from-shared-list-race-md) — The exact-list conversion path can promote an item reclaimed by concurrent clear or resize, producing an ASan crash.\n6. [Shared CSV Reader state race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-006-csv-shared-reader-state-race-md) — Concurrent `next()` calls can reallocate and corrupt the Reader's unlocked parser buffer and state.\n7. [Shared CSV Writer record-buffer race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-007-csv-shared-writer-buffer-race-md) — Concurrent `writerow()` calls can overwrite one another and emit a row containing mixed input generations.\n8. [`FrameLocalsProxy.__getitem__()` extra-local race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-008-frame-locals-proxy-extra-getitem-race-md) — Concurrent proxy assignment or deletion can reclaim a borrowed extra-local value before promotion.\n9. [Writable live-frame fast-local race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-009-frame-locals-proxy-fast-local-race-md) — Proxy replacement can free a fast-local value while the evaluator or `PyFrame_GetVar()` is acquiring it, causing impossible object state and allocator corruption.\n10. [Function closure replacement during frame initialization](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-010-function-set-closure-frame-init-race-md) — Concurrent closure replacement can release the tuple and cell while an unstarted frame initializes its free variables.\n11. [Unsynchronized whole-interpreter `PyConfig` access](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-011-interpreter-config-whole-copy-unlocked-md) — Concurrent configuration setters and readers produce heap-use-after-free failures in wide-string-list copying and conversion.\n12. [Shared itertools combinator advancement](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-012-itertools-combinator-shared-next-md) — Concurrent `next()` calls corrupt mutable state in `product`, `combinations`, `combinations_with_replacement`, and `permutations`.\n13. [Shared `itertools.tee` cache race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-013-itertools-tee-shared-data-race-md) — Concurrent advancement can expose an uninitialized shared-cache slot to `Py_NewRef`, crashing both same-branch and sibling-branch modes.\n14. [Managed `__dict__` replacement false miss](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-014-managed-inline-attribute-dict-replacement-race-md) — Attribute lookup can report `AttributeError` after inline storage is invalidated even though the replacement dictionary contains the attribute.\n15. [OrderedDict borrowed-value promotion race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-015-ordereddict-borrowed-value-promotion-race-md) — Fixed-key replacement can reclaim values consumed by `setdefault()`, `copy()`, or values iteration and corrupt the allocator.\n16. [OrderedDict unlocked node state](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-016-ordereddict-unlocked-node-state-md) — Concurrent structural operations can invalidate the coupled base-dictionary table, fast-node array, and linked nodes during lookup.\n17. [`partial.__repr__()` keyword-dictionary race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-017-partial-repr-keyword-dict-race-md) — Fixed-key replacement can reclaim a borrowed keyword value before formatting promotes it.\n18. [Exact-dictionary pickle batching race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-018-pickle-batch-dict-exact-unlocked-traversal-md) — Concurrent dictionary mutation can reclaim a borrowed entry before `batch_dict_exact` promotes it, producing an ASan crash.\n19. [Exact-list pickle batching race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-019-pickle-batch-list-exact-unpinned-item-md) — Concurrent list replacement or resize can reclaim an item before `batch_list_exact` promotes it.\n20. [`pickle.whichmodule()` `sys.modules` race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-020-pickle-whichmodule-unlocked-sys-modules-md) — Concurrent synthetic-module replacement can reclaim a borrowed module entry during the fallback scan and crash reference promotion.\n21. [`_PyConfig_FromDict()` nested-list race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-021-pyconfig-fromdict-shared-nested-list-md) — Concurrent mutation of `warnoptions` can retire a raw list item before its type check and conversion.\n22. [`globals[\"__builtins__\"]` replacement race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-022-shared-globals-builtins-borrow-race-md) — Evaluation can consume a borrowed builtins object after concurrent replacement frees it, causing stack or mutex corruption.\n23. [SQLite converter-registry race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-023-sqlite-converter-registry-borrow-race-md) — Concurrent public-registry replacement can finalize a borrowed converter before the cursor row-cast map owns it.\n24. [`str.maketrans()` shared-dictionary race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-024-unicode-maketrans-shared-dict-traversal-md) — Concurrent clear or replacement can retire borrowed keys and values, producing impossible translation tables or reclaimed objects.\n25. [`warnings.filters` list race](https://gist.github.com/Nievesjyl/575345587a5b226451c78b8f99155f6d#file-025-warnings-filter-list-race-md) — Direct list mutation can finalize a borrowed filter tuple before `get_filter()` inspects and promotes it, producing an ASan crash.\n","author":{"url":"https://github.com/Nievesjyl","@type":"Person","name":"Nievesjyl"},"datePublished":"2026-09-08T18:05:27Z","url":"https://github.com/python/cpython/issues/157196"}