GHSA-6w4m-2xhg-2658 is a critical-severity (CVSS 9.8) CWE-190 vulnerability in pysha3. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for pysha3 — see the affected versions and patch details below.
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for GHSA-6w4m-2xhg-2658.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
pysha3💎sha3Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI, RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Impact
The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.
Patches
Yes, see commit fdc6fef0.
Workarounds
The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.
References
See issue #105 for more details.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | pysha3 | all versions | No fix |
| 💎RubyGems | sha3 | all versions | 1.0.5bundle update sha3 --conservative |
Affected Products
debian linuxdebianextended keccak code packageextended_keccak_code_package_projectfedorafedoraprojectphpphppypypypypysha3pysha3_projectResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for pysha3, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
A fix is available for GHSA-6w4m-2xhg-2658; check the affected-versions list above or the advisory for the patched release of pysha3, then make sure no transitive dependency still pins the vulnerable range.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Python as shipped with Red Hat Red Hat Enterprise Linux is not affected by this flaw as it uses the OpenSSL SHA-3 implementation. PHP as shipped with Red Hat Enterprise Linux is affected but not vulnerable by default as it depends of the memory_limit[1] configuration setting to have a value of -1, indicating there is…
Library users can limit the size of partial input data or partial output digest to below 4294967096 bytes. Avoiding the queuing functions altogether by processing the entire input or producing the entire output at once does not trigger this vulnerability.Source: Red Hat security advisory for GHSA-6w4m-2xhg-2658 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 8 | php:8.0-8070020230118114629.ef331662 | RHSA-2023:0848 |
| Red Hat Enterprise Linux 8 | php:7.4-8080020230118140634.cc342424 | RHSA-2023:2903 |
| Red Hat Enterprise Linux 9 | php-0:8.0.27-1.el9_1 | RHSA-2023:0965 |
| Red Hat Enterprise Linux 9 | php:8.1-9020020230120141750.9 | RHSA-2023:2417 |
Frequently Asked Questions
Is GHSA-6w4m-2xhg-2658 in your dependencies?
Find it across PyPI, RubyGems, including transitive dependencies.