ImportError: DLL load failed while importing _cache: Access is denied on Windows starting in v0.149.16 (Regression from v0.149.12) #1791

Activity

1. bokjo commented on Jun 12, 2026

   

   bokjo

   on Jun 12, 2026

   Last edited by bokjo

   More actions

   We had a similar issue yesterday, the security system flagged and blocked the exe from starting that includes the zeroconf cache DLL (zeroconf_cache.cp313-win_amd64.pyd).

   Application information:
   Application name:	Python
   Application version:	3.13.13150.1013
   Application publisher:	Python Software Foundation
   Process ID:	31352
   Application location:	C:\Users\[REDACTED]\AppData\Local\[REDACTED]\python\python.exe
   Command line:	"C:\Users\[REDACTED]\AppData\Local\[REDACTED]\python\python.exe" C:\Users\[REDACTED]\AppData\Local\[REDACTED]\python/Scripts/config.exe create
   File origin:	Hard drive on this computer
   
   Prevention information:
   Prevention date:	Thursday, 11 June 2026
   Prevention time:	08:38:36
   OS version:	10.0.26100.2.0.0.256.1
   Component:	Hash Control
   Status code:	c0400058
   Prevention description:	Suspicious DLL detected
   Additional information 1:	C:\Users\[REDACTED]\AppData\Local\[REDACTED]\python\Lib\site-packages\zeroconf\_cache.cp313-win_amd64.pyd
   Additional information 2:	D26F276CBAAA652E0B35A3688304E69180031808F6DABC1C09FF9BC7596B1D19
   Additional information 3:	D26F276CBAAA652E0B35A3688304E69180031808F6DABC1C09FF9BC7596B1D19
   Additional information 4:	1
   Additional information 6:	{"trigger":2,"component":309,"cystatus":3225419864,"filePath":"C:\\Users\\[REDACTED]\\AppData\\Local\\[REDACTED]\\python\\Lib\\site-packages\\zeroconf\\_cache.cp313-win_amd64.pyd","fileHash":{"sha256":"D26F276CBAAA652E0B35A3688304E69180031808F6DABC1C09FF9BC7596B1D19","sha1":"62CD21AEF60686888F57611205FE0FBD242EA485","md5":"5EA3BC6B68BA772BE723987906530EC2"},"streamHash":{"sha256":"D26F276CBAAA652E0B35A3688304E69180031808F6DABC1C09FF9BC7596B1D19","sha1":"62CD21AEF60686888F57611205FE0FBD242EA485","md5":"5EA3BC6B68BA772BE723987906530EC2"},"verdict":1,"fileType":2,"fileSize":"186368","streamFileType":2,"streamSize":"186368"}
   
2. bdraco commented on Jun 12, 2026

   

   bdraco

   on Jun 12, 2026

   Member

   More actions

   Package checks out and tests pass with this version so maybe it's some type of malware scanner hitting a false positive
3. bokjo commented on Jun 12, 2026

   

   bokjo

   on Jun 12, 2026

   More actions

   Package checks out and tests pass with this version so maybe it's some type of malware scanner hitting a false positive

   This indeed is coming from Palo Alto Cortex XDR, pinned to 0.147.4 for now, as a workaround solves the issue!

   Has something changed in your release/bundle pipeline recently (signing/certs)?

   This started happening with last week's bundles on our side, will try to understand from which version onwards!
4. bdraco commented on Jun 12, 2026

   

   bdraco

   on Jun 12, 2026

   Member

   More actions

   I don't think anything has changed besides the cython version