CVE-2019-19275: typed-ast Out-of-Bounds Read Vulnerability
Summary
CVE-2019-19275: typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. Affects typed-ast across 5 version ranges.
< 1.3.2
< 156afcb26c198e162504a57caddfe0acd9ed7dce
< a4d78362397fc3bced6ea80fbc7b5f4827aec55e
< dc317ac9cff859aa84eeabe03fb5004982545b3b
< dcfcd146f8e6fc5c2fc16a4c192a0c5f5ca8c53c
Fixed in 156afcb26c198e162504a57caddfe0acd9ed7dce. How to fix ↓
Also tracked for
- python3-typed-ast · Debian:11
The same CVE-2019-19275 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
typed_ast is a Python package that provides a Python 3 compatible AST (Abstract Syntax Tree) representation of Python source code. It is commonly used for static analysis and code generation. The vulnerability affects versions 1.3.0 and 1.3.1 of typed_ast, as well as certain Python 3.8.0-alpha prereleases. An attacker with the ability to cause a Python interpreter to parse Python source code (without executing it) can exploit this vulnerability to crash the interpreter process. This could be a concern in web-based services that parse Python code.
Vulnerability Detail
The typed_ast package, specifically versions 1.3.0 and 1.3.1, has an out-of-bounds read vulnerability in the ast_for_arguments function. This vulnerability allows an attacker to crash the Python interpreter process by providing specially crafted Python source code. Although the vulnerability does not allow arbitrary code execution, it can disrupt the functionality of services that parse Python code. The issue also affects certain Python 3.8.0-alpha prereleases. The vulnerability was fixed in typed_ast version 1.3.2.
How To Fix
Latest published version: 1.5.5 as of 23 Oct 2026
pip install --upgrade "typed-ast==1.5.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
156afcb26c198e162504a57caddfe0acd9ed7dce
This is the first release that contains the fix.
pip install --upgrade "typed-ast==156afcb26c198e162504a57caddfe0acd9ed7dce"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The typed_ast package, specifically versions 1.3.0 and 1.3.1, is vulnerable to an out-of-bounds read issue in the ast_for_arguments function. This can be exploited by an attacker to crash the Python interpreter process. It is recommended to update the typed_ast package to version 1.3.2 or later to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typed-ast →
FAQ
typed_ast is a Python package that provides an AST representation of Python source code. It is commonly used for static analysis and code generation.
Versions 1.3.0 and 1.3.1 of typed_ast are affected, as well as certain Python 3.8.0-alpha prereleases.
An attacker can crash the Python interpreter process by providing specially crafted Python source code. This can disrupt the functionality of services that parse Python code.
No, the vulnerability only allows for crashing the interpreter process. Arbitrary code execution is not possible.
To fix the vulnerability, update the typed_ast package to version 1.3.2 or later by running 'pip install --upgrade typed-ast'.
References
Related vulnerabilities
Recent vulnerabilities recorded for typed-ast.
