AIKIDO-2026-561892
greenlet is vulnerable to Use After Free
20
Low Risk
This Affects:
greenletTL;DR
On free-threaded (no-GIL) builds of CPython, greenlet's saved C-stack state could become inconsistent if the garbage collector ran while a greenlet was suspended, leading to a use-after-free and interpreter crash. A related issue could deadlock the interpreter if a greenlet switch happened while a critical section lock was held.
Who does this affect?
You are affected only if you run a free-threaded (no-GIL) build of CPython 3.14 or newer and use greenlet-based libraries (such as gevent or Playwright's sync API) under garbage-collector pressure; this can cause unpredictable crashes or, less commonly, a deadlock. Standard GIL-enabled CPython builds are not affected.
Background info
greenlet is vulnerable to Use After Free in versions 3.3.0 - 3.5.3.
How to fix this
Upgrade the greenlet library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant