GHSA-36hh-v3qg-5jq4

High

Advisory

Published 11 Jun 2026In the index since 14 Oct 2026

PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators

Carried by container images the latest versions of 3 of 18,117 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
pyo3cargo	0.26.0, 0.28.3	0.29.0	2

3 by stars

Chart

Latest

Affected images

Radar Score

litellmquench-litellm

1 of the 1 container images this version deploys carry GHSA-36hh-v3qg-5jq4.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/litellmdigest-pinned	50e9b958e120	pyo3@0.26.0	0.29.0

100

llm-stackquench-llm-stack

1 of the 3 container images this version deploys carry GHSA-36hh-v3qg-5jq4.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/litellmdigest-pinned	50e9b958e120	pyo3@0.26.0	0.29.0

196

prefectquench-prefect

1 of the 2 container images this version deploys carry GHSA-36hh-v3qg-5jq4.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/prefectdigest-pinned	8bb6ad37a430	pyo3@0.28.3	0.29.0

107

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/quenchworks/images/litellm	50e9b958e120	pyo3@0.26.0	0.29.0	2
ghcr.io/quenchworks/images/prefect	8bb6ad37a430	pyo3@0.28.3	0.29.0	1