{"id":"CVE-2022-48560","title":"A use-after-free exists in Python through 3.9 via heappushpop in heapq.","summary":"A use-after-free exists in Python through 3.9 via heappushpop in heapq.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-416"],"vendor":"python","product":"python","affected":["python < 3.6.11","python >= 3.7.0, < 3.7.7","python >= 3.8.0, < 3.8.2","python = 3.9.0","debian_linux = 10.0"],"patched":["python 3.8.2"],"published":"2023-08-22","updated":"2026-10-14","sourceUpdated":"2026-10-14T19:16:56.573","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-48560","references":[{"url":"https://bugs.python.org/issue39421","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20230929-0008/","label":"cve@mitre.org"},{"url":"https://bugs.python.org/issue39421","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20230929-0008/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.01771,"epssPercentile":0.77704,"ingestedAt":"2026-10-14T19:49:57.531Z","slug":"CVE-2022-48560","body":"## Overview\n\nA use-after-free exists in Python through 3.9 via heappushpop in heapq.\n\n## Affected\n\n- `python < 3.6.11`\n- `python >= 3.7.0, < 3.7.7`\n- `python >= 3.8.0, < 3.8.2`\n- `python = 3.9.0`\n- `debian_linux = 10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `python 3.8.2`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}