{"id":"CVE-2023-37365","aliases":["GHSA-xwc8-rf6m-xr86","PYSEC-2026-1450"],"title":"hnswlib Double Free vulnerability","summary":"hnswlib Double Free vulnerability","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","vendor":"hnswlib","product":"hnswlib","ecosystem":"pip","affected":["hnswlib < 0.8.0"],"patched":["hnswlib 0.8.0"],"published":"2023-06-30","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xwc8-rf6m-xr86","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37365"},{"url":"https://github.com/nmslib/hnswlib/issues/467"},{"url":"https://github.com/nmslib/hnswlib/pull/484"},{"url":"https://github.com/nmslib/hnswlib/commit/f6d170ce0b41f9e75ace473b09df6e7872590757"},{"url":"https://github.com/nmslib/hnswlib"}],"tags":["osv","pip"],"epss":0.00586,"epssPercentile":0.4676,"ingestedAt":"2026-07-08T18:25:54.703Z","slug":"CVE-2023-37365","body":"## Overview\n\nHnswlib 0.7.0 has a double free in `init_index` when the M argument is a large integer.\n\n## Affected packages\n\n- `hnswlib < 0.8.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `hnswlib 0.8.0`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}