---
id: CVE-2023-37365
aliases:
  - GHSA-xwc8-rf6m-xr86
  - PYSEC-2026-1450
title: hnswlib Double Free vulnerability
summary: hnswlib Double Free vulnerability
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
vendor: hnswlib
product: hnswlib
ecosystem: pip
affected:
  - hnswlib < 0.8.0
patched:
  - hnswlib 0.8.0
published: '2023-06-30'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-xwc8-rf6m-xr86'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-37365'
  - url: 'https://github.com/nmslib/hnswlib/issues/467'
  - url: 'https://github.com/nmslib/hnswlib/pull/484'
  - url: >-
      https://github.com/nmslib/hnswlib/commit/f6d170ce0b41f9e75ace473b09df6e7872590757
  - url: 'https://github.com/nmslib/hnswlib'
tags:
  - osv
  - pip
epss: 0.00586
epssPercentile: 0.45729
ingestedAt: '2026-07-08T18:25:54.703Z'
---

## Overview

Hnswlib 0.7.0 has a double free in `init_index` when the M argument is a large integer.

## Affected packages

- `hnswlib < 0.8.0`

## Remediation

Upgrade to a patched release:

- `hnswlib 0.8.0`