May 18, 2025 · May 18, 2025
diff --git a/Lib/test/test_importlib/import_/test_relative_imports.py b/Lib/test/test_importlib/import_/test_relative_imports.py
            self.__import__('sys', {'__package__': '', '__spec__': None},
                            level=1)

    def test_malicious_relative_import(self):
        # https://github.com/python/cpython/issues/134100
        # Test to make sure UAF bug with error msg doesn't come back to life
        import sys
        loooong = "".ljust(0x23000, "b")
        name = f"a.{loooong}.c"

        with util.uncache(name):
            sys.modules[name] = {}
            with self.assertRaisesRegex(
                KeyError,
                r"'a\.b+' not in sys\.modules as expected"
            ):
                __import__(f"{loooong}.c", {"__package__": "a"}, level=1)


 (Frozen_RelativeImports,
 Source_RelativeImports
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst
 Fix a use-after-free bug that occurs when an imported module isn't
 in :data:`sys.modules` after its initial import. Patch by Nico-Posada.
diff --git a/Python/import.c b/Python/import.c
                }

                final_mod = import_get_module(tstate, to_return);
                Py_DECREF(to_return);
                if (final_mod == NULL) {
                    if (!_PyErr_Occurred(tstate)) {
                        _PyErr_Format(tstate, PyExc_KeyError,
                                      "%R not in sys.modules as expected",
                                      to_return);
                    }
                    Py_DECREF(to_return);
                    goto error;
                }

                Py_DECREF(to_return);
            }
        }
        else {
Original file line number	Diff line number	Diff line change
Expand Up		@@ -223,6 +223,21 @@ def test_relative_import_no_package_exists_absolute(self):
		self.__import__('sys', {'__package__': '', '__spec__': None},
		level=1)

		def test_malicious_relative_import(self):
		# https://github.com/python/cpython/issues/134100
		# Test to make sure UAF bug with error msg doesn't come back to life
		import sys
		loooong = "".ljust(0x23000, "b")
		name = f"a.{loooong}.c"

		with util.uncache(name):
		sys.modules[name] = {}
		with self.assertRaisesRegex(
		KeyError,
		r"'a\.b+' not in sys\.modules as expected"
		):
		__import__(f"{loooong}.c", {"__package__": "a"}, level=1)


		(Frozen_RelativeImports,
		Source_RelativeImports
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Fix a use-after-free bug that occurs when an imported module isn't
		in :data:`sys.modules` after its initial import. Patch by Nico-Posada.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3852,15 +3852,17 @@ PyImport_ImportModuleLevelObject(PyObject name, PyObject globals,
		}

		final_mod = import_get_module(tstate, to_return);
		Py_DECREF(to_return);
		if (final_mod == NULL) {
		if (!_PyErr_Occurred(tstate)) {
		_PyErr_Format(tstate, PyExc_KeyError,
		"%R not in sys.modules as expected",
		to_return);
		}
		Py_DECREF(to_return);
		goto error;
		}

		Py_DECREF(to_return);
		}
		}
		else {
Expand Down