{"kind": "product", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "name": "python-pip", "product": "python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS", "items": [{"id": "CVE-2026-97689", "noindex": false, "published": "2026-09-29T15:36:05.963Z", "modified": "2026-09-29T16:23:23.167Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.00335, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-97689", "title": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory", "description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "references": ["https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw", "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed", "https://github.com/urllib3/urllib3/releases/tag/2.8.0"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-97688", "noindex": false, "published": "2026-09-29T15:32:17.622Z", "modified": "2026-09-29T15:42:34.502Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00292, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-97688", "title": "urllib3: Chunked Deflate streaming can enter an infinite loop", "description": "urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechani", "references": ["https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g", "https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f", "https://github.com/urllib3/urllib3/releases/tag/2.8.0"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-97687", "noindex": false, "published": "2026-09-29T15:30:27.136Z", "modified": "2026-09-30T20:11:09.721Z", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00206, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-97687", "title": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden", "description": "urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.ver", "references": ["https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77", "https://github.com/urllib3/urllib3/pull/5093", "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-13346", "noindex": false, "published": "2026-07-29T18:33:50.820Z", "modified": "2026-07-29T20:21:34.281Z", "cvss": 5.6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00292, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-13346", "title": "pip absolute path traversal during download from malicious package indexes", "description": "pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.", "references": ["https://github.com/pypa/pip/pull/14110", "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/", "http://www.openwall.com/lists/oss-security/2026/07/29/7"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-57585", "noindex": false, "published": "2026-06-30T21:36:23.418Z", "modified": "2026-07-01T14:54:36.191Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00488, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57585", "title": "MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error", "description": "MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.", "references": ["https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964", "https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d", "https://nvd.nist.gov/vuln/detail/CVE-2026-57585"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-9375", "noindex": false, "published": "2026-06-19T19:16:00Z", "modified": "2026-10-14T11:47:37.965604919Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-9375", "title": "UBUNTU-CVE-2026-9375", "description": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "references": ["https://ubuntu.com/security/CVE-2026-9375", "https://www.cve.org/CVERecord?id=CVE-2026-9375", "https://huntr.com/bounties/ddd09eb9-b87d-4a43-84df-48837b1bbc23"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-45409", "noindex": false, "published": "2026-06-05T22:06:07.082Z", "modified": "2026-06-08T16:34:00.295Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00408, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45409", "title": "Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix", "description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in", "references": ["https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx", "https://nvd.nist.gov/vuln/detail/CVE-2026-45409"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-8643", "noindex": false, "published": "2026-06-01T15:01:32.143Z", "modified": "2026-09-16T12:04:18.796Z", "cvss": 4.1, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0032, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-8643", "title": "pip can extract console_scripts and gui_scripts outside installation directory", "description": "pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.", "references": ["https://github.com/pypa/pip/pull/14000", "https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/", "http://www.openwall.com/lists/oss-security/2026/06/01/5"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-44431", "noindex": false, "published": "2026-05-13T15:20:24.588Z", "modified": "2026-06-26T11:01:19.373Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00331, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44431", "title": "urllib3: Sensitive headers forwarded across origins in proxied low-level redirects", "description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "references": ["https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc", "https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-44432", "noindex": false, "published": "2026-05-13T15:17:12.611Z", "modified": "2026-09-10T12:04:48.735Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.0068, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44432", "title": "urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API", "description": "urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decom", "references": ["https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j", "https://access.redhat.com/security/cve/CVE-2026-44432", "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-6357", "noindex": false, "published": "2026-04-27T14:19:47.657Z", "modified": "2026-04-27T22:17:49.582Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00138, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6357", "title": "pip self-update functionality can import newly installed modules after wheel installation", "description": "pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.", "references": ["https://github.com/pypa/pip/pull/13923", "https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes", "http://www.openwall.com/lists/oss-security/2026/04/27/7"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-3219", "noindex": false, "published": "2026-04-20T14:55:38.282Z", "modified": "2026-04-20T20:15:23.710Z", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00144, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-3219", "title": "pip doesn't reject concatenated ZIP and tar archives", "description": "pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing \"incorrect\" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.", "references": ["https://github.com/pypa/pip/pull/13870", "https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ/", "http://www.openwall.com/lists/oss-security/2026/04/20/8"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-25645", "noindex": false, "published": "2026-03-25T17:02:48.402Z", "modified": "2026-03-25T22:48:33.406Z", "cvss": 4.4, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-25645", "title": "Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function", "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-d", "references": ["https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2", "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7", "https://github.com/psf/requests/releases/tag/v2.33.0"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-1703", "noindex": false, "published": "2026-02-02T14:43:02.919Z", "modified": "2026-02-02T17:21:25.369Z", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00443, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-1703", "title": "Limited path traversal when installing wheel archives", "description": "When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.", "references": ["https://github.com/pypa/pip/pull/13777", "https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735", "https://mail.python.org/archives/list/security-announce@python.org/thread/WIEA34D4TABF2UNQJAOMXKCICSPBE2DJ/"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-24049", "noindex": false, "published": "2026-01-22T04:02:08.706Z", "modified": "2026-09-16T12:04:16.072Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "high", "epss": 0.0035, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-24049", "title": "wheel Allows Arbitrary File Permission Modification via Path Traversal", "description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writa", "references": ["https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx", "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef", "https://github.com/pypa/wheel/releases/tag/0.46.2"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2026-21441", "noindex": false, "published": "2026-01-07T22:09:01.936Z", "modified": "2026-09-17T12:04:39.688Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.02922, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-21441", "title": "urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)", "description": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decomp", "references": ["https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99", "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b", "https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2025-66471", "noindex": false, "published": "2025-12-05T16:06:08.531Z", "modified": "2025-12-05T19:33:14.832Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.00682, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-66471", "title": "urllib3 Streaming API improperly handles highly compressed data", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompresse", "references": ["https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37", "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7", "https://nvd.nist.gov/vuln/detail/CVE-2025-66471"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2025-8869", "noindex": false, "published": "2025-09-24T14:56:56.027Z", "modified": "2025-11-03T17:45:31.574Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00469, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-8869", "title": "Fallback tar extraction in pip doesn't check symbolic links point to extraction directory", "description": "When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.\nNote that upgrading pip to a \"fixed\" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.\n\nNote that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706\nand therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706\nthen pip doesn't use the \"vulnerable\" fallback co", "references": ["https://github.com/pypa/pip/pull/13550", "https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN/", "https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html"], "fixes": [], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2025-47273", "noindex": false, "published": "2025-05-17T15:46:11.399Z", "modified": "2025-05-28T15:03:15.516Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.01592, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-47273", "title": "setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write", "description": "setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.", "references": ["https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf", "https://github.com/pypa/setuptools/issues/4946", "https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b"], "fixes": ["9.0.1-2.3~ubuntu1.18.04.8+esm8"], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}, {"id": "CVE-2024-6345", "noindex": false, "published": "2024-07-15T00:00:14.545Z", "modified": "2025-11-04T16:15:51.183Z", "cvss": 8.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01939, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-6345", "title": "Remote Code Execution in pypa/setuptools", "description": "A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.", "references": ["https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5", "https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0", "https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"], "fixes": ["9.0.1-2.3~ubuntu1.18.04.8+esm4"], "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}]}], "total": 29, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "python-pip", "path": "vulns/ubuntu-pro-18.04-lts/python-pip", "ecosystem": "Ubuntu:Pro:18.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 3, "kev": 0}, "lastmod": "2026-10-14T11:47:37.965604919Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}