René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CPython 3.15: consolidated memory-safety and concurrency bugs","articleBody":"Hello,\n\nThis issue consolidates 13 reproducible CPython 3.15 bugs involving memory safety and concurrency.\n\nThe bugs resulted from Python security research using static analysis. Each entry has a concrete PoC in the linked version-specific Gist. Although the collection is large, these bugs warrant inspection, especially the cases producing interpreter crashes, sanitizer failures, memory corruption, or similarly concrete failures.\n\n## Bugs\n\n1. [AST initialization `_field_types` race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-001-ast-init-field-types-borrow-promotion-md) — Concurrent descriptor replacement can reclaim a borrowed value and cause an impossible initialization decision.\n2. [Bytes formatting shared-bytearray race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-002-bytes-format-shared-bytearray-md) — A peer can modify bytearray storage while `%b` formatting copies it, producing a mixed-generation result.\n3. [Verbose module-finalization stderr reentry](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-003-finalize-remove-modules-verbose-stderr-reentry-md) — A `sys.__stderr__` callback can release borrowed `sys.modules` entries before finalization uses them.\n4. [Unexpected-keyword dictionary traversal race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-004-getargs-unexpected-keyword-dict-traversal-md) — Concurrent mutation can reclaim a borrowed keyword while diagnostics convert and format it.\n5. [Import traceback-chain frame race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-005-import-traceback-chain-borrow-race-md) — Traceback mutation can detach a node and release its borrowed frame during import cleanup.\n6. [Child memoryview construction and source-release race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-006-memoryview-getbuffer-release-race-md) — Source release can deallocate the managed buffer between the released check and child export acquisition.\n7. [`object.__getstate__()` inline-dictionary transition race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-007-object-getstate-inline-dict-empty-transition-md) — Concurrent dictionary replacement can make a nonempty object incorrectly report an empty state.\n8. [OrderedDict reentrant keys-table corruption](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-008-odict-get-index-reentrant-ma-keys-md) — A colliding comparison can replace the cached keys table, causing an unrelated key to move.\n9. [`_posixsubprocess.fork_exec()` process-argument race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-009-posixsubprocess-process-args-borrow-promotion-md) — Concurrent list replacement can finalize a borrowed argument before filesystem conversion.\n10. [`BinaryReader` operation and close race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-010-remote-debugging-binary-reader-close-race-md) — `get_stats()` or callback-resumed replay can access native reader state freed by `close()`.\n11. [Concurrent `BinaryReader.replay()` state corruption](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-011-remote-debugging-binary-reader-replay-state-race-md) — Simultaneous replays can corrupt shared reconstruction arrays, stacks, depths, and counters.\n12. [`BinaryWriter.get_stats()` and close race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-012-remote-debugging-binary-writer-close-race-md) — Concurrent `close()` can destroy the native writer before an unlocked stats call finishes using it.\n13. [`BinaryWriter.write_sample()` input-list race](https://gist.github.com/Nievesjyl/88b08474bc010dfb7b8c7d14e3705aa5#file-013-remote-debugging-binary-writer-shared-input-lists-md) — Concurrent mutation can reclaim outer, thread, or frame-list items before their fields are read.\n","author":{"url":"https://github.com/Nievesjyl","@type":"Person","name":"Nievesjyl"},"datePublished":"2026-09-08T19:25:51Z","url":"https://github.com/python/cpython/issues/157198"}