python / python/cpython

Ensure that HMAC objects are properly initialized

Open
#155,843 0 comments 0 reactions 1 assignee View on GitHub

@picnixz is already working on this.

Since Aug 15, 2026.

extension-modules type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

This affects the following situations:

  • _hmac.new() frees an uninitialized HACL pointer when the key exceeds UINT32_MAX
  • _hmac_HMAC_copy_impl runs HASHLIB_INIT_MUTEX(copy) after the fallible hmac_copy_state

The solution is simply to always entirely initialize the HMAC object before working with it. We also change the usage of PyObject_New to tp->tp_alloc directly so that we only alter fields for which the 0-value would not be suitable.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs
  • gh-155845
  • gh-157036
  • gh-157037

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.