USN-8344-2
python-pip regression
USN-8344-1 fixed vulnerabilities in pip. On Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS the patches for CVE-2025-66471 caused a regression when using pip. The patches for CVE-2025-66471 have been temporarily reverted pending investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that pip incorrectly handled TLS certificate verification in session connections. If a session was first used with certificate verification disabled, subsequent requests to the same host would also skip verification regardless of the session's current settings. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and expose sensitive information. (CVE-2024-35195)
It was discovered that pip's bundled urllib3 library did not limit the number of decompression steps when processing HTTP responses. A remote attacker could possibly use this issue to cause pip to consume excessive resources, leading to a denial of service. (CVE-2025-66418)
It was discovered that pip's bundled urllib3 library improperly handled streaming decompression of highly compressed data. A remote attacker could possibly use this issue to cause pip to consume excessive resources, leading to a denial of service. (CVE-2025-66471)
What each source reports
OSV No score
python-pip regression
USN-8344-1 fixed vulnerabilities in pip. On Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS the patches for CVE-2025-66471 caused a regression when using pip. The patches for CVE-2025-66471 have been temporarily reverted pending investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that pip incorrectly handled TLS certificate verification in session connections. If a session was first used with certificate verification disabled, subsequent requests to the same host would also skip verification regardless of the session's current settings. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and expose sensitive information. (CVE-2024-35195)
It was discovered that pip's bundled urllib3 library did not limit the number of decompression steps when processing HTTP responses. A remote attacker could possibly use this issue to cause pip to consume excessive resources, leading to a denial of service. (CVE-2025-66418)
It was discovered that pip's bundled urllib3 library improperly handled streaming decompression of highly compressed data. A remote attacker could possibly use this issue to cause pip to consume excessive resources, leading to a denial of service. (CVE-2025-66471)
- Record
USN-8344-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-pipUbuntu:Pro:22.04:LTS |
before 22.0.2+dfsg-1ubuntu0.7+esm2, plus listed versions 20.3.4-421.3.1+dfsg-322.0.2+dfsg-122.0.2+dfsg-1ubuntu0.122.0.2+dfsg-1ubuntu0.2 Show 6 moreShow less22.0.2+dfsg-1ubuntu0.322.0.2+dfsg-1ubuntu0.422.0.2+dfsg-1ubuntu0.522.0.2+dfsg-1ubuntu0.622.0.2+dfsg-1ubuntu0.722.0.2+dfsg-1ubuntu0.7+esm1 |
22.0.2+dfsg-1ubuntu0.7+esm2 |
python-pipUbuntu:Pro:24.04:LTS |
before 24.0+dfsg-1ubuntu1.3+esm2, plus listed versions 23.2+dfsg-123.3+dfsg-124.0+dfsg-124.0+dfsg-1ubuntu124.0+dfsg-1ubuntu1.124.0+dfsg-1ubuntu1.224.0+dfsg-1ubuntu1.324.0+dfsg-1ubuntu1.3+esm1 |
24.0+dfsg-1ubuntu1.3+esm2 |
python-pipUbuntu:Pro:26.04:LTS |
before 25.1.1+dfsg-1ubuntu2+esm2, plus listed versions 25.1.1+dfsg-1ubuntu225.1.1+dfsg-1ubuntu2+esm1 |
25.1.1+dfsg-1ubuntu2+esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8344-2 is a vulnerability with no CVSS score yet in python-pip, published May 29, 2026. No source lists public exploit code. Fixed in python-pip 22.0.2+dfsg-1ubuntu0.7+esm2.