Umbrella issue: bugs found using cpython-review-toolkit
Open
Nobody has claimed this yet.
extension-modules
interpreter-core
type-bug
type-crash
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 35.9k
- PR merge metrics
- PR metrics pending
Description
Bug report
What happened?
This is an umbrella issue for 50 select bugs found using cpython-review-toolkit, distributed across ~350K lines of CPython C code (Modules/, Objects/, Python/).
Feel free to work on any report, opening an issue if one doesn't exist yet. Comment with the issue and respective gist/bug here and I'll update the table. If you find an issue listed below that is a duplicate of an existing report, let me know and I'll also mark it in the table.
Modules/ (18 gists)
| Gist | Description | CPython Issue |
|---|---|---|
| gist | _ssl.c: Py_DECREF(NULL) in SNI callback | #146080 FIXED |
| gist | _sqlite: collation assertion + missing PyErr_NoMemory | #146090 FIXED |
| gist | functools partial PyDict_Contains -1 as truthy | #146075 FIXED |
| gist | _csv.c: _set_str missing NULL check | #146093 FIXED |
| gist | _zoneinfo: SEGV in get_weak_cache | #146076 FIXED |
| gist | _zoneinfo: missing PyErr_NoMemory in load_data | #146092 FIXED |
| gist | termios: NULL to PyLong_AsLong | #146091 FIXED |
| gist | _struct: segfault/assertion on uninitialized Struct | Fixed in https://github.com/python/cpython/commit/515ae4078dffa0b74e5e5431462c2f4fe4563ffa |
| gist | pyexpat: ExternalEntityParserCreate crash | Fixed in https://github.com/python/cpython/commit/e6b9a1406980fbb1d4032eca9cc0b4f8f252b716 |
| gist | _interpqueuesmodule: use-after-free dangling last | #146427 |
| gist | selectmodule: errno < 0 always false | #146205 FIXED |
| gist | _lsprof: exception clobbering | #153068 FIXED |
| gist | deque.copy() ref corruption on OOM | #152017 |
| gist | readline: begidx NULL on OOM | #154385 |
| gist | zlibmodule: PyErr_NewException unchecked | false alarm |
| gist | socketmodule: audit hook ref/buffer leaks | #146245 FIXED |
| gist | _interpchannelsmodule: missing PyErr_NoMemory | https://github.com/python/cpython/issues/150213 FIXED |
| gist | _interpretersmodule: SEGV on create under OOM | Fixed in https://github.com/python/cpython/commit/d06113c7a7cac76a28847702685e601b79f71bf8 |
Objects/ (13 gists)
| Gist | Description | CPython Issue |
|---|---|---|
| gist | ExceptionGroup repr OOB — 3-line segfault | #146096 FIXED |
| gist | SyntaxError.__init__ ref leaks on re-init |
#146250 FIXED |
| gist | codeobject: code_richcompare swallows errors | #146199 FIXED |
| gist | codeobject: co_tlbc NULL + replacement_locations leak | — |
| gist | weakref WRAP_BINARY ref leak (~20 operators) | #153058 |
| gist | FrameLocalsProxy swallows/overwrites errors | — |
| gist | typeobject: missing return -1 in type_ready | commit c398490fbf15ede5de3389b4ca4e32fb9a7c5d67 |
| gist | typeobject: buffer leak in slot_bf_getbuffer | https://github.com/python/cpython/pull/151346 FIXED |
| gist | object.c: PyObject_Print missing LeaveRecursiveCall | commit e2fa10e04d3fed4c248881d69411fc208d05ad6b |
| gist | structseq: get_type_attr_as_size NULL deref | #148119 FIXED |
| gist | genericaliasobject: two NULL dereference bugs | https://github.com/python/cpython/pull/148226 FIXED |
| gist | odictobject: spurious PyErr_Clear | https://github.com/python/cpython/pull/151347 FIXED |
| gist | unicode_format: wrong return + PY_SSIZE_T_MIN UB | #151845 #151847 |
Python/ (16 gists)
| Gist | Description | CPython Issue |
|---|---|---|
| gist | import.c: wrong interpreter + double lock release | #150454 #150374 FIXED |
| gist | instrumentation.c: PyLong leak per monitoring call | #150379 FIXED |
| gist | instrumentation.c: use-after-Py_DECREF comparison | https://github.com/python/cpython/issues/151524 |
| gist | ceval.c: missing PyErr_NoMemory + PyEval_GetLocals NULL | #153205 FIXED |
| gist | bltinmodule: __lazy_import__ NULL deref |
#151510 FIXED |
| gist | crossinterp: UAF + leaked exception + shadowed var | — |
| gist | compiler pipeline: 6 ref leaks and error bugs | https://github.com/python/cpython/issues/146442 FIXED |
| gist | marshal: 8 refs leaked on corrupt TYPE_CODE | #148418 FIXED |
| gist | pylifecycle: 5 init/fini cleanup bugs | — |
| gist | initconfig: SET_ITEM macro leaks dict | #146244 FIXED |
| gist | ast.c: LEAVE_RECURSIVE missing on 30 paths | — |
| gist | hamt.c: sub_node leaked in bitmap ops | https://github.com/python/cpython/issues/150178 |
| gist | pythonrun: main_module ref leak | https://github.com/python/cpython/issues/146355 FIXED |
| gist | modsupport: missing va_end (UB) | https://github.com/python/cpython/issues/146386 FIXED |
| gist | legacy_tracing: unchecked PyLong_AsInt | #153622 |
| gist | optimizer_symbols: make_bottom NULL deref | https://github.com/python/cpython/issues/146388 FIXED |
Duplicates (3 gists — same bugs uploaded from different runs)
| Gist | Duplicate of |
|---|---|
| gist | ExceptionGroup repr (dup of dceaa8b7) |
| gist | sqlite collation (dup of 69aff7ff) |
| gist | SSL SNI (dup of 50f98806) |
These issues were found with Claude Opus 4.6, using the /cpython-review-toolkit:explore [file or directory] all deep command.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.15.0a7+ (heads/main:e0f7c1097e1, Mar 17 2026, 18:10:52) [Clang 21.1.2 (2ubuntu6)]
Linked PRs
- gh-146443
- gh-151342
- gh-151346
- gh-151347
- gh-151534
- gh-151578
- gh-154278
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Choose one unassigned report from the table, then read its linked gist and any corresponding CPython issue. Start in the named area—Modules/, Objects/, or Python/—and follow the report's specific description. The work is done when the selected bug has a focused fix or issue and the umbrella table is updated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, python
- Domain
- backend, compilers
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100