René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CPython 3.14: consolidated memory-safety and concurrency bugs","articleBody":"Hello,\n\nThis issue consolidates 100 reproducible CPython 3.14 bugs involving memory safety and concurrency.\n\nThe bugs resulted from Python security research using static analysis. Each entry has a concrete PoC in the linked version-specific Gist. Although the collection is large, these bugs warrant inspection, especially the cases producing interpreter crashes, sanitizer failures, memory corruption, or similarly concrete failures.\n\n## Bugs\n\n1. [`array.fromlist()` source-list element race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-001-array-fromlist-borrow-promotion-md) — Same-size slot replacement can reclaim a borrowed list element before descriptor conversion uses it.\n2. [Code-assembly metadata dictionary race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-002-assemble-metadata-dict-race-md) — Concurrent metadata resize can produce inconsistent CFG offsets and counts used by raw array writes.\n3. [AST `__replace__()` `_field_types` race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-003-ast-replace-field-types-traversal-race-md) — Concurrent dictionary mutation can invalidate borrowed `_field_types` entries during traversal.\n4. [Exporter-less buffered-I/O callback views](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-004-bufferedio-exporterless-callback-views-md) — A retained callback memoryview can outlive the temporary or internal allocation it exposes.\n5. [`bytearray.__init__()` storage race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-005-bytearray-init-unlocked-storage-md) — Concurrent initialization can leave one thread writing its old requested length through smaller or freed storage.\n6. [Codec-cache callable promotion race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-006-codec-cache-item-borrow-promotion-md) — Cache invalidation can destroy a selected codec callable before it is promoted.\n7. [`codecs.unregister()` search-path race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-007-codec-unregister-search-path-race-md) — Two unregister calls can invalidate the saved list index and cause an unconditional null decrement.\n8. [`_collections._count_elements()` value race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-008-collections-count-elements-shared-dict-md) — Concurrent replacement can reclaim a borrowed dictionary value before the fast path increments it.\n9. [Shared Context HAMT iterator race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-009-contextvars-hamt-shared-iterator-next-md) — Concurrent `next()` calls can combine incompatible traversal levels, positions, and node pointers.\n10. [Cross-interpreter namespace dictionary race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-010-crossinterp-shared-namespace-dict-md) — Concurrent growth can overrun native namespace storage, while replacement can reclaim a value before conversion.\n11. [`_ctypes.Structure` `_fields_` lifetime race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-011-ctypes-fields-borrow-after-dict-release-md) — Concurrent deletion can release the `_fields_` sequence after its dictionary snapshot is dropped but before construction uses it.\n12. [ctypes `_anonymous_` list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-012-ctypes-shared-anonymous-list-md) — Concurrent clear or resize can invalidate raw list storage and borrowed field names during structure construction.\n13. [ctypes nested `_fields_` list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-013-ctypes-shared-fields-list-md) — Anonymous-field expansion can consume invalidated list storage or reclaimed field tuples.\n14. [`_curses.window.encoding` double-free race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-014-curses-window-encoding-race-md) — Concurrent setters can both free the same native encoding pointer.\n15. [Decimal formatting override race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-015-decimal-format-override-borrow-promotion-md) — Concurrent replacement can reclaim a borrowed override string before UTF-8 conversion.\n16. [Decimal signal dictionary race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-016-decimal-signal-dict-borrow-promotion-md) — Concurrent replacement can reclaim a signal value before truth testing dispatches through it.\n17. [`dict.update()` sequence-pair race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-017-dict-merge-seq2-borrow-promotion-md) — Concurrent replacement can destroy a borrowed key or value before destination insertion.\n18. [`Element.append()` and `Element.clear()` race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-018-elementtree-append-clear-md) — Append can dereference detached representation state or write through freed child storage.\n19. [`Element.get()` attribute-reset race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-019-elementtree-attrib-read-mutation-md) — Concurrent reset can free the extra representation and attribute dictionary before the reader owns them.\n20. [Element child-reader race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-020-elementtree-child-read-mutation-md) — Structural mutation can detach child storage between validation and borrowed-child promotion.\n21. [Element structural-writer race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-021-elementtree-child-write-mutation-md) — Concurrent writes can move, overwrite, or decrement child storage another operation has freed or replaced.\n22. [XML parser entity-value race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-022-elementtree-entity-unpinned-value-md) — Concurrent entity replacement can reclaim a borrowed value before or during TreeBuilder use.\n23. [`Element.get()` dictionary-value promotion race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-023-elementtree-get-dict-value-borrow-promotion-md) — Concurrent attribute replacement can reclaim the returned value before `Py_XNewRef()` promotes it.\n24. [`XMLParser._setevents()` input-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-024-elementtree-setevents-shared-input-list-md) — Concurrent clear or refill can invalidate the saved size, list entry, or bytes storage.\n25. [Element shared-list input race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-025-elementtree-shared-input-list-md) — `extend()`, slice assignment, and `__setstate__()` can consume invalidated list storage or unpinned children.\n26. [Concurrent `XMLParser.feed()` state corruption](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-026-elementtree-shared-xmlparser-feed-md) — Simultaneous parser methods can corrupt shared Expat, handler, cache, and error state.\n27. [`float(bytearray)` storage race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-027-float-bytearray-unpinned-storage-md) — Concurrent resize can relocate the bytearray while numeric parsing uses its earlier pointer and size.\n28. [CFG constants-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-028-flowgraph-consts-list-race-md) — Concurrent clear or refill can reclaim a constant or invalidate list storage during optimization.\n29. [`FrameLocalsProxy` traversal race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-029-frame-locals-proxy-items-race-md) — Extra-local deletion or replacement can reclaim dictionary entries before result construction promotes them.\n30. [`functools.partial.__setstate__()` state race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-030-functools-partial-concurrent-setstate-md) — Concurrent mutation can expose reclaimed argument storage or an incoherent mixture of partial fields.\n31. [`gc.callbacks` promotion race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-031-gc-callback-borrow-promotion-md) — List mutation can reclaim a borrowed callback before the collector promotes and invokes it.\n32. [Concurrent generator frame entry](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-032-generator-concurrent-entry-md) — Two threads can enter and concurrently corrupt the same embedded interpreter frame.\n33. [CFG conversion and `InstructionSequence` growth race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-033-instruction-sequence-cfg-race-md) — Concurrent growth can reallocate an instruction array while CFG conversion retains raw pointers into it.\n34. [Concurrent `InstructionSequence` method race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-034-instruction-sequence-concurrent-mutation-md) — Concurrent array growth and snapshots can lose updates, double-free allocations, or traverse moving storage.\n35. [`itertools.pairwise()` state race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-035-itertools-pairwise-shared-next-md) — Shared `next()` calls can promote stale state, over-decrement an element, or simultaneously reuse one result tuple.\n36. [`itertools._tee_dataobject()` values-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-036-itertools-tee-data-shared-values-md) — Concurrent clear or resize can invalidate bounds and reclaim a value before promotion.\n37. [`_json` exact-dictionary traversal race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-037-json-dict-borrow-promotion-md) — Concurrent mutation can reclaim a borrowed key or value before encoding owns it.\n38. [`_json` custom-mapping items-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-038-json-mapping-items-borrow-promotion-md) — An externally retained items list can replace and reclaim a tuple before recursive encoding.\n39. [`_json` sequence traversal race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-039-json-sequence-borrow-promotion-md) — Concurrent element replacement can destroy the last owner before promotion or recursive use.\n40. [`_locale.setlocale()` return-pointer race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-040-locale-setlocale-return-pointer-race-md) — A concurrent locale change can free libc's process-global string while another thread decodes it.\n41. [`marshal.dumps()` container traversal race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-041-marshal-dumps-shared-containers-md) — Concurrent mutation can invalidate list storage or reclaim dictionary entries during serialization.\n42. [`marshal.load()` retained `readinto()` view](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-042-marshal-load-retained-readinto-view-md) — A callback-retained memoryview can remain live after its private native buffer is reallocated or freed.\n43. [`memoryview.cast()` shape-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-043-memoryview-cast-shape-borrow-md) — Concurrent replacement can reclaim a borrowed shape integer before type and value checks.\n44. [`memoryview.__hash__` release race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-044-memoryview-hash-release-md) — Release can drop the final buffer lease while hashing still reads the raw address.\n45. [Non-contiguous `memoryview.hex()` release race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-045-memoryview-hex-noncontiguous-release-md) — Release and exporter resize can invalidate the buffer, shape, and strides during copying.\n46. [`memoryview.tobytes()` release race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-046-memoryview-tobytes-release-md) — Release can permit exporter resize while the copy still reads its old address.\n47. [`module_dir()` callable promotion race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-047-module-dir-borrow-promotion-md) — Concurrent `__dir__` replacement can destroy the borrowed callable before dispatch.\n48. [Concurrent multibyte stream-reader race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-048-multibyte-streamreader-shared-read-md) — Shared `read()` calls can corrupt codec state, pending input, errors, and Unicode-writer transitions.\n49. [`OSError.__reduce__()` args race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-049-oserror-reduce-args-race-md) — Concurrent assignment can reclaim the args tuple or its elements between separate reads.\n50. [Pickling a resizing bytearray](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-050-pickle-bytearray-unpinned-storage-md) — Protocol 5 can copy from released storage or combine pointer and length from different generations.\n51. [Pickler dispatch-table reducer race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-051-pickle-dispatch-table-unpinned-reducer-md) — Concurrent dispatch replacement can reclaim a borrowed reducer before the Pickler promotes it.\n52. [Unpickler donor-memo copy race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-052-pickle-donor-memo-copy-race-md) — Donor growth can reallocate the raw memo array while another Unpickler copies its slots.\n53. [Pickle extension-cache promotion race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-053-pickle-extension-cache-borrow-promotion-md) — Concurrent cache clearing can reclaim a borrowed object before it is promoted and pushed.\n54. [`Unpickler.find_class()` mapping race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-054-pickle-find-class-unpinned-mapping-md) — Compatibility-map replacement can reclaim tuples and strings during import and global lookup.\n55. [`_pickle.fix_imports()` mapping race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-055-pickle-fix-imports-unpinned-mapping-md) — Reverse compatibility-map replacement can reclaim borrowed names while they are validated and promoted.\n56. [`_pickle.load_build()` state-dictionary race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-056-pickle-load-build-shared-state-iteration-md) — Concurrent state mutation can invalidate traversal and reclaim keys or values during assignment.\n57. [`_pickle.load_extension()` registry race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-057-pickle-load-extension-unpinned-registry-md) — Concurrent registry replacement can reclaim the module and class names during resolution.\n58. [Pickle memo-setter dictionary race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-058-pickle-memo-setter-shared-dict-iteration-md) — Concurrent source mutation can invalidate traversal or reclaim entries before validation and insertion.\n59. [Shared Unpickler running-guard race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-059-pickle-shared-unpickler-running-guard-md) — Two callers can bypass the non-atomic guard and concurrently mutate one Unpickler's native state.\n60. [Unpickler memo-proxy storage race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-060-pickle-unpickler-memo-proxy-race-md) — Copy can traverse memo storage that concurrent clear or assignment has detached and freed.\n61. [`os.posix_spawn()` file-action list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-061-posix-spawn-file-actions-list-race-md) — Concurrent replacement can reclaim a borrowed action tuple before parsing.\n62. [`PyUnstable_Exc_PrepReraiseStar()` list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-062-prep-reraise-star-shared-list-md) — Concurrent exception-list mutation can invalidate an entry before type and metadata access.\n63. [Stale specialized property-getter cache](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-063-property-reinit-specialization-cache-md) — Reinitializing a property does not invalidate the owning type version, leaving specialized bytecode with a collected getter pointer.\n64. [`PyArg_Parse` bytearray resize race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-064-pyarg-et-bytearray-resize-md) — The `et` formats can read released bytearray storage during `strlen()` or `memcpy()`.\n65. [`PyConfig_Set()` container-validation race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-065-pyconfig-set-shared-container-md) — Concurrent list or dictionary mutation can invalidate entries before configuration type checks.\n66. [`pyexpat.xmlparser` handler-slot race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-066-pyexpat-handler-slot-race-md) — Handler replacement can leave getters and callbacks using stale or invalid slot contents.\n67. [`pyexpat.ParseFile()` bytearray race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-067-pyexpat-parsefile-bytearray-resize-md) — A peer can resize the returned bytearray while native code copies from its saved address and length.\n68. [Concurrent `pyexpat` native-state corruption](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-068-pyexpat-shared-parser-native-state-race-md) — Simultaneous parses can invalidate shared Expat tables, buffers, lists, and retained pointers.\n69. [`PyFunction_GetAnnotations()` lazy-state race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-069-pyfunction-getannotations-race-md) — Concurrent setters can reclaim annotation fields or cause publication from inconsistent generations.\n70. [`PyImport_GetImporter()` path-hook race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-070-pyimport-getimporter-path-hooks-race-md) — Concurrent `sys.path_hooks` mutation can invalidate a slot or reclaim a hook before its call.\n71. [`int(bytearray)` storage race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-071-pynumber-long-bytearray-storage-md) — Concurrent resize can make integer parsing scan released storage or mismatched pointer and length generations.\n72. [`PyObject_Call()` shared-kwargs race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-072-pyobject-call-shared-kwargs-md) — Concurrent mutation can reclaim kwargs entries or make traversal exceed the allocated call arrays.\n73. [`PySys_GetObject()` borrowed-return race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-073-pysys-getobject-borrowed-return-md) — Concurrent sys-dictionary replacement can reclaim the object before the caller promotes or uses it.\n74. [`RawIOBase.read()` callback-buffer race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-074-rawiobase-readinto-buffer-resize-md) — A published callback bytearray can be resized while native code copies the originally reported byte count.\n75. [`select.select()` descriptor-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-075-select-shared-fd-list-md) — Concurrent mutation can invalidate saved bounds or reclaim a fetched descriptor before promotion.\n76. [`compile(bytearray)` source-storage race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-076-source-bytearray-unpinned-storage-md) — Concurrent resize can relocate or free source storage while scanning and parsing continue.\n77. [SQLite converter-registry race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-077-sqlite-converter-registry-race-md) — Concurrent registry replacement can reclaim a returned converter before the row-cast map owns it.\n78. [SQLite connection cursor-registry race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-078-sqlite-shared-connection-cursor-registry-md) — Concurrent append and cleanup can invalidate registry storage, references, or lose cursor registrations.\n79. [Concurrent SQLite cursor-step race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-079-sqlite-shared-cursor-step-md) — Two `fetchone()` calls can inspect or advance the same `sqlite3_stmt` concurrently.\n80. [SQLite parameter-list promotion race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-080-sqlite-shared-parameter-list-md) — Concurrent list mutation can reclaim a parameter before promotion, adaptation, or binding.\n81. [`_sre.compile()` code-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-081-sre-compile-shared-code-list-md) — Concurrent mutation can invalidate the saved length or reclaim an opcode before conversion.\n82. [`_sre.Match` group-index race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-082-sre-match-shared-groupindex-md) — Concurrent dictionary replacement can reclaim a group-index integer before use.\n83. [`_sre.template()` list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-083-sre-template-shared-list-md) — Concurrent mutation can invalidate bounds or reclaim literals and group indices before conversion.\n84. [SSL password bytearray race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-084-ssl-password-bytearray-resize-md) — Concurrent resize can release password storage before the native copy completes.\n85. [SSL weak-socket referent race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-085-ssl-weak-socket-borrow-md) — The helper drops its strong reference before returning, allowing concurrent destruction before caller use.\n86. [`_struct` bytearray packing race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-086-struct-pack-bytearray-unpinned-storage-md) — Concurrent resize can relocate or free `'s'` and `'p'` source storage during copying.\n87. [Struct-sequence input-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-087-structseq-list-borrow-promotion-md) — Concurrent replacement can finalize an input item before the new struct sequence owns it.\n88. [Struct-sequence metadata race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-088-structseq-type-metadata-borrow-race-md) — Concurrent heap-type metadata replacement can reclaim an integer before conversion and corrupt constructor bounds.\n89. [Suggestion candidate-list traversal race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-089-suggestions-shared-candidate-list-md) — Concurrent mutation can invalidate bounds, reclaim a candidate, or reclaim the selected result before promotion.\n90. [`_generate_suggestions()` list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-090-suggestions-shared-candidates-list-md) — Concurrent clear or replacement can invalidate a slot or reclaim an entry before calculation.\n91. [`syslog.openlog()` `sys.argv[0]` race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-091-syslog-argv0-borrow-promotion-md) — Concurrent replacement can destroy the borrowed program name before promotion and UTF-8 conversion.\n92. [`termios.tcsetattr()` attribute-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-092-termios-tcsetattr-shared-attributes-md) — Concurrent outer or inner list mutation can invalidate control-character entries before conversion.\n93. [`TextIOWrapper.tell()` reentrant snapshot release](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-093-textiowrapper-tell-reentrant-snapshot-uaf-md) — A decoder callback can re-enter `seek()`, release the snapshot, and leave the outer call using freed input bytes.\n94. [`_tkinter._flatten()` shared-list race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-094-tkinter-flatten-shared-list-md) — Concurrent clear and refill can invalidate exact-list storage during flattening.\n95. [Traceback `sys.path` item race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-095-traceback-syspath-item-borrow-md) — Concurrent replacement can reclaim a borrowed path string before source-file lookup encodes it.\n96. [`type.__subclasses__()` bases race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-096-type-subclasses-bases-race-md) — Concurrent `__bases__` mutation can invalidate borrowed subclass references during dictionary traversal.\n97. [Unicode encoder shared-bytearray race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-097-unicode-encoder-shared-bytearray-md) — A codec can return a shared bytearray that another thread resizes during the bytes copy.\n98. [`_PyUnicode_FromId()` shared-array growth race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-098-unicode-fromid-array-growth-race-md) — Concurrent identifiers can reallocate and publish the shared array while another thread accesses freed storage.\n99. [`ZstdCompressor` options-dictionary race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-099-zstd-compressor-shared-options-md) — Concurrent clearing can reclaim borrowed option keys or values before conversion.\n100. [`ZstdDecompressor` options-dictionary race](https://gist.github.com/Nievesjyl/cb42885ecb5c6329d23bc01105c0bde6#file-100-zstd-decompressor-shared-options-md) — Concurrent clearing can reclaim borrowed option keys or values before conversion.\n","author":{"url":"https://github.com/Nievesjyl","@type":"Person","name":"Nievesjyl"},"datePublished":"2026-09-08T19:18:31Z","url":"https://github.com/python/cpython/issues/157197"}