Internet Bug Bounty · Report #159693

Py_DECREF on a non-owned object in the _sre module

Validstatus

1upvotes

12 Nov 2019disclosed

How it was found

I described this vulnerability in detail in a mail to the PSRT. A copy of my email, plus the fix for this issue, can be found here:

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original