https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:49:53 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07739 bdu:2026-07739 https://cve.radiocsirt.org/vuln/bdu:2026-07739 https://cve.radiocsirt.org/vuln/bell-cve-2026-25645 <p><strong>Affected:</strong> Alpaquita:23: py3-requests, Alpaquita:25: py3-requests, Alpaquita:stream: py3-requests</p> <p><strong>Affected:</strong> Alpaquita:23: py3-requests, Alpaquita:25: py3-requests, Alpaquita:stream: py3-requests</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-25645 https://cve.radiocsirt.org/vuln/brew-abi3audit-cve-2026-25645 <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.</p> <p>### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.</p> <p>### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.</p> <p>If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.</p> <p>### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.</p> <p>### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.</p> <p>If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> https://cve.radiocsirt.org/vuln/brew-abi3audit-cve-2026-25645 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0381 certfr-2026-avi-0381 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0381 https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 https://cve.radiocsirt.org/vuln/euvd-2026-277487 EUVD-2026-277487 https://cve.radiocsirt.org/vuln/euvd-2026-277487 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25645 <p>Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> <p>Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25645 https://cve.radiocsirt.org/vuln/ghsa-gc5v-m9x4-r6x2 <p><strong>Affected:</strong> PyPI: requests</p> <p>### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.</p> <p>### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.</p> <p>### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.</p> <p>If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> <p><strong>Affected:</strong> PyPI: requests</p> <p>### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.</p> <p>### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.</p> <p>### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.</p> <p>If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> https://cve.radiocsirt.org/vuln/ghsa-gc5v-m9x4-r6x2 https://cve.radiocsirt.org/vuln/msrc_cve-2026-25645 msrc_CVE-2026-25645 https://cve.radiocsirt.org/vuln/msrc_cve-2026-25645 https://cve.radiocsirt.org/vuln/oesa-2026-1791 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python-requests, openEuler:24.03-LTS-SP2: python-requests, openEuler:24.03-LTS-SP3: python-requests, openEuler:20.03-LTS-SP4: python-requests, openEuler:22.03-LTS-SP4: python-requests, openEuler:24.03-LTS: python-requests</p> <p>Requests is an HTTP library, written in Python, as an alternative to Python&amp;amp;apos;s builtin urllib2 which requires work (even method overrides) to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. + Multipart File Uploads. + CookieJar Support. + Redirection History. + Redirection Recursion Urllib Fix. + Automatic Decompression of GZipped Content. + Unicode URL Support. - Authentication: + URL + HTTP Auth Registry. Security Fix(es):</p> <p>Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python-requests, openEuler:24.03-LTS-SP2: python-requests, openEuler:24.03-LTS-SP3: python-requests, openEuler:20.03-LTS-SP4: python-requests, openEuler:22.03-LTS-SP4: python-requests, openEuler:24.03-LTS: python-requests</p> <p>Requests is an HTTP library, written in Python, as an alternative to Python&amp;amp;apos;s builtin urllib2 which requires work (even method overrides) to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. + Multipart File Uploads. + CookieJar Support. + Redirection History. + Redirection Recursion Urllib Fix. + Automatic Decompression of GZipped Content. + Unicode URL Support. - Authentication: + URL + HTTP Auth Registry. Security Fix(es):</p> <p>Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)</p> https://cve.radiocsirt.org/vuln/oesa-2026-1791 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10455-1 <p>python311-requests-2.33.0-1.1 on GA media</p> <p>python311-requests-2.33.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10455-1 https://cve.radiocsirt.org/vuln/pysec-2026-2275 <p><strong>Affected:</strong> PyPI: requests</p> <p>Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> <p><strong>Affected:</strong> PyPI: requests</p> <p>Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2275 https://cve.radiocsirt.org/vuln/rhsa-2026:56431 <p>golang: net/url: Memory exhaustion in query parameter parsing in net/url crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate js-yaml: js-yaml prototype pollution in merge react-router: React Router unexpected external redirect undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: Undici: HTTP header injection and request smuggling vulnerability undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header form-data: form-data: Form field override via CRLF injection undici: undici: Denial…</p> <p>golang: net/url: Memory exhaustion in query parameter parsing in net/url crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate js-yaml: js-yaml prototype pollution in merge react-router: React Router unexpected external redirect undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: Undici: HTTP header injection and request smuggling vulnerability undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header form-data: form-data: Form field override via CRLF injection undici: undici: Denial…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:56431 https://cve.radiocsirt.org/vuln/suse-su-2026:1218-1 <p>Security update for python-requests</p> <p>Security update for python-requests</p> https://cve.radiocsirt.org/vuln/suse-su-2026:1218-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-25645 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: requests, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: requests, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:24.04:LTS: requests, Ubuntu:Pro:24.04:LTS: python-pip, Ubuntu:25.10: python-pip and 3 more</p> <p>Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: requests, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: requests, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:24.04:LTS: requests, Ubuntu:Pro:24.04:LTS: python-pip, Ubuntu:25.10: python-pip and 3 more</p> <p>Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-25645