Every CVE Search/ Get API key

CVE-2026-25645

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

4.4 MediumPublic exploitFix available

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.19%Up 0.2 points since Mar 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.4

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
CVE-2026-25645
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-377
Updated
2026-11-02
EUVDEUVD-2026-15754 4.4

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
EUVD-2026-15754
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-gc5v-m9x4-r6x2 4.4

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Impact

The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.

Affected usages

Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted.

Remediation

Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.

If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
GHSA-gc5v-m9x4-r6x2
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-377
Updated
2026-11-02
NVD 4.4

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
CVE-2026-25645
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-377
Updated
2026-11-02
OSVALPINE-CVE-2026-25645 5.5

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
ALPINE-CVE-2026-25645
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-25645 5.5
Record
BELL-CVE-2026-25645
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 23 moreShow less
OSV 4.4

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
CVE-2026-25645
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-377
Updated
2026-11-02
OSVDEBIAN-CVE-2026-25645 5.5

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
DEBIAN-CVE-2026-25645
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-gc5v-m9x4-r6x2 4.4

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Impact

The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.

Affected usages

Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted.

Remediation

Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.

If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
GHSA-gc5v-m9x4-r6x2
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-377
Updated
2026-11-02
OSVOESA-2026-1791 5.5

python-requests security update

Requests is an HTTP library, written in Python, as an alternative to Python's builtin urllib2 which requires work (even method overrides) to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. + Multipart File Uploads. + CookieJar Support. + Redirection History. + Redirection Recursion Urllib Fix. + Automatic Decompression of GZipped Content. + Unicode URL Support. - Authentication: + URL + HTTP Auth Registry.

Security Fix(es):

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.(CVE-2026-25645)

Record
OESA-2026-1791
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-1909 5.5

python-pip security update

%changelog * Fri Feb 13 2026 Linux_zhang <[email protected]> - 23.3.1-9 - Fix CVE-2026-21441

Security Fix(es):

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.(CVE-2026-25645)

Record
OESA-2026-1909
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVPYSEC-2026-2275 5.5

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
PYSEC-2026-2275
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-25645 5.5

CVE-2026-25645 in rootio-requests - Patched by Root

Root has patched CVE-2026-25645 in the rootio-requests package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-25645
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-25645 4.4

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
UBUNTU-CVE-2026-25645
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVAZL-80996 No score

CVE-2026-25645 affecting package python-requests for versions less than 2.31.0-4

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Record
AZL-80996
Updated
2026-11-05
OSVCLSA-2026-1780879897 No score

TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.32.3.post2+tuxcare.

Record
CLSA-2026-1780879897
Updated
2026-11-02
OSVCLSA-2026-1781225614 No score

TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.31.0.post2+tuxcare.

Record
CLSA-2026-1781225614
Updated
2026-11-02
OSVCLSA-2026-1781225615 No score

TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.30.0.post2+tuxcare.

Record
CLSA-2026-1781225615
Updated
2026-11-02
OSVCLSA-2026-1787551818 No score

TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.25.1.post2+tuxcare.

Record
CLSA-2026-1787551818
Updated
2026-11-02
OSVopenSUSE-SU-2026:10455-1 No score

python311-requests-2.33.0-1.1 on GA media

These are all security issues fixed in the python311-requests-2.33.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10455-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20926-1 No score

Security update for python-requests

This update for python-requests fixes the following issue:

  • CVE-2026-25645: extract_zipped_paths() uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589).
Record
openSUSE-SU-2026:20926-1
Updated
2026-11-02
OSVSUSE-SU-2026:1218-1 No score

Security update for python-requests

This update for python-requests fixes the following issues:

  • CVE-2026-25645: extract_zipped_paths() uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589).
Record
SUSE-SU-2026:1218-1
Updated
2026-11-02
OSVSUSE-SU-2026:1644-1 No score

Security update for python-requests

This update for python-requests fixes the following issues:

  • CVE-2026-25645: extract_zipped_paths() uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589).
Record
SUSE-SU-2026:1644-1
Updated
2026-11-02
OSVSUSE-SU-2026:1647-1 No score

Security update for python-requests

This update for python-requests fixes the following issues:

  • CVE-2026-25645: extract_zipped_paths() uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589).
Record
SUSE-SU-2026:1647-1
Updated
2026-11-02
OSVSUSE-SU-2026:21036-1 No score

Security update for python-requests

This update for python-requests fixes the following issue:

  • CVE-2026-25645: extract_zipped_paths() uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589).
Record
SUSE-SU-2026:21036-1
Updated
2026-11-02
OSVSUSE-SU-2026:21063-1 No score

Security update for python-requests

This update for python-requests fixes the following issue:

  • CVE-2026-25645: extract_zipped_paths() uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589).
Record
SUSE-SU-2026:21063-1
Updated
2026-11-02
OSVSUSE-SU-2026:22055-1 No score

Security update for python-requests

This update for python-requests fixes the following issue:

  • CVE-2026-25645: extract_zipped_paths() uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589).
Record
SUSE-SU-2026:22055-1
Updated
2026-11-02
OSVSUSE-SU-2026:22091-1 No score

Security update for python-requests

This update for python-requests fixes the following issue:

  • CVE-2026-25645: extract_zipped_paths() uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589).
Record
SUSE-SU-2026:22091-1
Updated
2026-11-02
OSVUSN-8825-1 No score

requests vulnerability

It was discovered that Requests did not correctly handle generating random temporary file paths. An attacker could possibly use this issue to execute arbitrary code.

Record
USN-8825-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
requests
PyPI
 before 2.33.0
2.33.0
py3-requests
Alpine:v3.20
 before 2.33.1-r0
2.33.1-r0
py3-requests
Alpine:v3.21
 before 2.33.1-r0
2.33.1-r0
py3-requests
Alpine:v3.22
 before 2.33.1-r0
2.33.1-r0
py3-requests
Alpine:v3.23
 before 2.33.1-r0
2.33.1-r0
py3-requests
Alpine:v3.24
 before 2.33.1-r0
2.33.1-r0
python-requests
Azure Linux:3
 before 2.31.0-4
2.31.0-4
py3-requests
Alpaquita:23
 2.28.1-r2 up to 2.28.1-r5
2.28.1-r5
py3-requests
Alpaquita:25
 2.32.3-r0 up to 2.32.5-r1
2.32.5-r1
py3-requests
Alpaquita:stream
 2.28.1-r2 up to 2.33.1-r0
2.33.1-r0
Show 45 moreShow less
Affected packages
PackageAffectedFixed
requests
TuxCare:PyPI
 2.32.3 up to 2.32.3.post2+tuxcare, plus listed versions
2.32.3.post1+tuxcare
2.32.3.post2+tuxcare
requests
TuxCare:PyPI
 2.31.0 up to 2.31.0.post2+tuxcare, plus listed versions
2.31.0.post1+tuxcare
2.31.0.post2+tuxcare
requests
TuxCare:PyPI
 2.30.0 up to 2.30.0.post2+tuxcare, plus listed versions
2.30.0.post1+tuxcare
2.30.0.post2+tuxcare
requests
TuxCare:PyPI
 2.25.1 up to 2.25.1.post2+tuxcare, plus listed versions
2.25.1.post1+tuxcare
2.25.1.post2+tuxcare
requests
Debian:12
 All versions, plus listed versions
2.28.1+dfsg-12.31.0+dfsg-12.31.0+dfsg-22.32.3+dfsg-12.32.3+dfsg-2
Show 7 moreShow less
2.32.3+dfsg-32.32.3+dfsg-42.32.3+dfsg-52.32.4+dfsg-12.32.5+dfsg-12.32.5+dfsg-22.34.2-1
 None known
requests
Debian:13
 All versions, plus listed versions
2.32.3+dfsg-52.32.3+dfsg-5+deb13u12.32.4+dfsg-12.32.5+dfsg-12.32.5+dfsg-22.34.2-1
 None known
requests
Debian:14
 before 2.34.2-1, plus listed versions
2.32.3+dfsg-52.32.4+dfsg-12.32.5+dfsg-12.32.5+dfsg-2
2.34.2-1
requests
PyPI
 before 2.33.0, plus listed versions
0.0.10.10.00.10.10.10.20.10.3
Show 45 moreShow less
0.10.40.10.60.10.70.10.80.11.10.11.20.12.00.12.010.12.10.13.00.13.10.13.20.13.30.13.40.13.50.13.60.13.70.13.80.13.90.14.00.14.10.14.20.2.00.2.10.2.20.2.30.2.40.3.00.3.10.3.20.3.30.3.40.4.00.4.10.5.00.5.10.6.00.6.10.6.20.6.30.6.40.6.50.6.60.7.00.7.1
2.33.0
python-requests
openEuler:24.03-LTS-SP1
 before 2.31.0-5.oe2403sp1
2.31.0-5.oe2403sp1
python-requests
openEuler:24.03-LTS-SP2
 before 2.31.0-5.oe2403sp2
2.31.0-5.oe2403sp2
python-requests
openEuler:24.03-LTS-SP3
 before 2.31.0-5.oe2403sp3
2.31.0-5.oe2403sp3
python-requests
openEuler:20.03-LTS-SP4
 before 2.24.0-6.oe2003sp4
2.24.0-6.oe2003sp4
python-requests
openEuler:22.03-LTS-SP4
 before 2.26.0-12.oe2203sp4
2.26.0-12.oe2203sp4
python-requests
openEuler:24.03-LTS
 before 2.31.0-5.oe2403
2.31.0-5.oe2403
python-pip
openEuler:22.03-LTS-SP4
 before 21.3.1-15.oe2203sp4
21.3.1-15.oe2203sp4
python-pip
openEuler:24.03-LTS
 before 23.3.1-10.oe2403sp3
23.3.1-10.oe2403sp3
python-pip
openEuler:24.03-LTS-SP1
 before 23.3.1-10.oe2403sp1
23.3.1-10.oe2403sp1
python-pip
openEuler:24.03-LTS-SP2
 before 23.3.1-10.oe2403sp2
23.3.1-10.oe2403sp2
python-pip
openEuler:24.03-LTS-SP3
 before 23.3.1-10.oe2403sp3
23.3.1-10.oe2403sp3
python-pip
openEuler:20.03-LTS-SP4
 before 20.2.2-16.oe2003sp4
20.2.2-16.oe2003sp4
rootio-requests
Root:PyPI
 before 2.32.5+root.io.1
2.32.5+root.io.12.32.3+root.io.22.28.1+root.io.12.28.2+root.io.12.30.0+root.io.12.29.0+root.io.12.30.0+root.io.22.32.0+root.io.12.32.5+root.io.22.32.0+root.io.22.32.3+root.io.32.32.2+root.io.12.32.4+root.io.12.31.0+root.io.22.31.0+root.io.32.32.2+root.io.22.28.2+root.io.22.31.0+root.io.42.32.3+root.io.42.30.0+root.io.32.32.5+root.io.32.29.0+root.io.22.32.0+root.io.32.32.4+root.io.22.28.1+root.io.22.17.0+root.io.42.17.0+root.io.52.25.1+root.io.62.32.4+root.io.32.32.2+root.io.32.32.3+root.io.52.32.0+root.io.4
requests
Root:PyPI
 before 2.28.1+aikido.1
2.28.1+aikido.12.29.0+aikido.12.28.2+aikido.22.31.0+aikido.42.32.3+aikido.42.30.0+aikido.32.32.5+aikido.32.29.0+aikido.22.32.0+aikido.32.32.4+aikido.22.28.1+aikido.22.17.0+aikido.42.17.0+aikido.5
python-requests
SUSE:Linux Enterprise Module for Public Cloud 12
 before 2.24.0-8.26.1
2.24.0-8.26.1
python-requests
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.24.0-8.26.1
2.24.0-8.26.1
python-requests
SUSE:Linux Micro 6.1
 before 2.32.4-slfo.1.1_2.1
2.32.4-slfo.1.1_2.1
python-requests
SUSE:Linux Micro 6.0
 before 2.32.3-3.1
2.32.3-3.1
python-requests
SUSE:Linux Micro 6.2
 before 2.32.4-160000.3.1
2.32.4-160000.3.1
python-requests
SUSE:Linux Enterprise Server 16.0
 before 2.32.4-160000.3.1
2.32.4-160000.3.1
python-requests
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.32.4-160000.3.1
2.32.4-160000.3.1
python-pip
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.4.1-21.5.4-11.5.4-1ubuntu11.5.4-1ubuntu31.5.4-1ubuntu4
Show 5 moreShow less
1.5.4-1ubuntu4+esm11.5.4-1ubuntu4+esm21.5.4-1ubuntu4+esm31.5.4-1ubuntu4+esm41.5.4-1ubuntu4+esm5
 None known
python-pip
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.6-7ubuntu11.5.6-7ubuntu28.0.2-78.0.3-18.0.3-2
Show 17 moreShow less
8.1.0-18.1.0-28.1.1-18.1.1-28.1.1-2ubuntu0.18.1.1-2ubuntu0.28.1.1-2ubuntu0.48.1.1-2ubuntu0.68.1.1-2ubuntu0.6+esm28.1.1-2ubuntu0.6+esm38.1.1-2ubuntu0.6+esm48.1.1-2ubuntu0.6+esm58.1.1-2ubuntu0.6+esm68.1.1-2ubuntu0.6+esm88.1.1-2ubuntu0.6+esm108.1.1-2ubuntu0.6+esm118.1.1-2ubuntu0.6+esm12
 None known
python-pip
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.1-29.0.1-2.3~ubuntu19.0.1-2.3~ubuntu1.18.04.19.0.1-2.3~ubuntu1.18.04.29.0.1-2.3~ubuntu1.18.04.3
Show 15 moreShow less
9.0.1-2.3~ubuntu1.18.04.49.0.1-2.3~ubuntu1.18.04.59.0.1-2.3~ubuntu1.18.04.5+esm29.0.1-2.3~ubuntu1.18.04.5+esm39.0.1-2.3~ubuntu1.18.04.69.0.1-2.3~ubuntu1.18.04.6+esm19.0.1-2.3~ubuntu1.18.04.79.0.1-2.3~ubuntu1.18.04.7+esm19.0.1-2.3~ubuntu1.18.04.89.0.1-2.3~ubuntu1.18.04.8+esm19.0.1-2.3~ubuntu1.18.04.8+esm29.0.1-2.3~ubuntu1.18.04.8+esm49.0.1-2.3~ubuntu1.18.04.8+esm69.0.1-2.3~ubuntu1.18.04.8+esm79.0.1-2.3~ubuntu1.18.04.8+esm8
 None known
requests
Ubuntu:Pro:20.04:LTS
 before 2.22.0-2ubuntu1.1+esm2, plus listed versions
2.21.0-12.22.0-2build12.22.0-2ubuntu12.22.0-2ubuntu1.12.22.0-2ubuntu1.1+esm1
2.22.0-2ubuntu1.1+esm2
python-pip
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
18.1-518.1-5build118.1-5ubuntu120.0.2-220.0.2-4
Show 16 moreShow less
20.0.2-520.0.2-5ubuntu120.0.2-5ubuntu1.120.0.2-5ubuntu1.320.0.2-5ubuntu1.420.0.2-5ubuntu1.520.0.2-5ubuntu1.620.0.2-5ubuntu1.720.0.2-5ubuntu1.820.0.2-5ubuntu1.920.0.2-5ubuntu1.1020.0.2-5ubuntu1.10+esm220.0.2-5ubuntu1.1120.0.2-5ubuntu1.11+esm220.0.2-5ubuntu1.11+esm320.0.2-5ubuntu1.11+esm4
 None known
requests
Ubuntu:22.04:LTS
 before 2.25.1+dfsg-2ubuntu0.4, plus listed versions
2.25.1+dfsg-22.25.1+dfsg-2ubuntu0.12.25.1+dfsg-2ubuntu0.3
2.25.1+dfsg-2ubuntu0.4
python-pip
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
20.3.4-421.3.1+dfsg-322.0.2+dfsg-122.0.2+dfsg-1ubuntu0.122.0.2+dfsg-1ubuntu0.2
Show 8 moreShow less
22.0.2+dfsg-1ubuntu0.322.0.2+dfsg-1ubuntu0.422.0.2+dfsg-1ubuntu0.522.0.2+dfsg-1ubuntu0.622.0.2+dfsg-1ubuntu0.722.0.2+dfsg-1ubuntu0.7+esm122.0.2+dfsg-1ubuntu0.7+esm222.0.2+dfsg-1ubuntu0.7+esm3
 None known
requests
Ubuntu:24.04:LTS
 before 2.31.0+dfsg-1ubuntu1.2, plus listed versions
2.31.0+dfsg-1ubuntu12.31.0+dfsg-1ubuntu1.1
2.31.0+dfsg-1ubuntu1.2
python-pip
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
23.2+dfsg-123.3+dfsg-124.0+dfsg-124.0+dfsg-1ubuntu124.0+dfsg-1ubuntu1.1
Show 5 moreShow less
24.0+dfsg-1ubuntu1.224.0+dfsg-1ubuntu1.324.0+dfsg-1ubuntu1.3+esm124.0+dfsg-1ubuntu1.3+esm224.0+dfsg-1ubuntu1.3+esm3
 None known
python-pip
Ubuntu:25.10
 All versions, plus listed versions
25.0+dfsg-125.1.1+dfsg-125.1.1+dfsg-1ubuntu125.1.1+dfsg-1ubuntu2
 None known
requests
Ubuntu:25.10
 All versions, plus listed versions
2.32.3+dfsg-4ubuntu12.32.3+dfsg-5ubuntu12.32.3+dfsg-5ubuntu2
 None known
python-pip
Ubuntu:26.10
 All versions, plus listed versions
25.1.1+dfsg-1ubuntu226.1.2+dfsg-1
 None known
requests
Ubuntu:26.04:LTS
 before 2.32.5+dfsg-1ubuntu1.1, plus listed versions
2.32.3+dfsg-5ubuntu22.32.5+dfsg-1ubuntu1
2.32.5+dfsg-1ubuntu1.1
python-pip
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
25.1.1+dfsg-1ubuntu225.1.1+dfsg-1ubuntu2+esm125.1.1+dfsg-1ubuntu2+esm225.1.1+dfsg-1ubuntu2+esm3
 None known
python-requests
openSUSE:Tumbleweed
 before 2.33.0-1.1
2.33.0-1.1
python-requests
openSUSE:Leap 16.0
 before 2.32.4-160000.3.1
2.32.4-160000.3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubJaycelation/CVE-2026-256452025-11-16

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-25645 is a medium vulnerability (CVSS 4.4) in Psf Requests, published March 25, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in requests 2.33.0.

References

Show 18 moreShow less
This page doesn't list everything

Left out here: 107 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open