diff --git a/ddtrace/appsec/_iast/_taint_tracking/_native.cpp b/ddtrace/appsec/_iast/_taint_tracking/_native.cpp index e0a64332431..f6ebe354c6b 100644 --- a/ddtrace/appsec/_iast/_taint_tracking/_native.cpp +++ b/ddtrace/appsec/_iast/_taint_tracking/_native.cpp @@ -72,6 +72,12 @@ PYBIND11_MODULE(_native, m) } initializer = make_unique(); + // Create an atexit callback to clean up the Initializer before the interpreter finishes + auto atexit_register = py::module_::import("atexit").attr("register"); + atexit_register(py::cpp_function([]() { + initializer->reset_context(); + initializer.reset(); + })); initializer->create_context(); m.doc() = "Native Python module"; diff --git a/releasenotes/notes/initializer-atexit-6f9a025488fe14b4.yaml b/releasenotes/notes/initializer-atexit-6f9a025488fe14b4.yaml new file mode 100644 index 00000000000..c1fe5fc835d --- /dev/null +++ b/releasenotes/notes/initializer-atexit-6f9a025488fe14b4.yaml @@ -0,0 +1,4 @@ +--- +fixes: + - | + Code Security: ensure the ``Initializer`` object is always reset and freed before the Python runtime.