CVE-2022-48560

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

2.0% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-25)

CWE

CWE-416

Published

2023-08-22

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• python:python

References

• https://bugs.python.org/issue39421
• https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/

Check your stackJSON