Repository navigation
ActiveState security release on the Python 3.9 pip 26.0.1 line. CPython 3.9.25.1 and 3.10.22.1 also bundle it. Merged in #15.
| CVE | Advisory | Status |
|---|---|---|
| CVE-2025-66418 | GHSA-gm62-xv2j-4w53 | Patched (vendored urllib3) |
| CVE-2025-66471 | GHSA-2xpw-w6gg-jr37 | Patched (vendored urllib3) |
| CVE-2026-21441 | GHSA-38jv-5279-wg99 | Patched (vendored urllib3) |
| CVE-2026-44431 | GHSA-qccp-gfcp-xxvc | Patched (vendored urllib3) |
| CVE-2026-97687 | GHSA-8988-9cw3-xx77 | Patched (vendored urllib3) |
| CVE-2026-97689 | GHSA-vxq7-64xx-v4gw | Patched (vendored urllib3) |
| CVE-2025-50181 | GHSA-pq67-6m6q-mj2v | Patched (vendored urllib3) |
| CVE-2026-25645 | GHSA-gc5v-m9x4-r6x2 | Patched (vendored requests, defense in depth) |
What changed:
- Vendored urllib3: 1.26.20 is replaced by ActiveState urllib3 1.26.20.post4, with pip's usual vendoring changes (Brotli disabled).
urllib3.__version__stays1.26.20. - Vendored requests 2.32.5: it carries upstream's two CVE-2026-25645 commits from 2.33.0 (66d21cb07b and e331a288f3). pip didn't reach the vulnerable path, because its vendored certifi already extracts the CA bundle.
- Unchanged: the 26.0.1.post2 fixes, including certifi 2026.10.23.
Validated on the built wheel, in python:3.9-slim and python:3.10-slim:
- Versions: the vendored packages report the expected versions, and there's no
RequestsDependencyWarning. - CVE-2026-25645:
extract_zipped_paths()doesn't reuse a planted file. - Network:
pip downloadand a--dry-runresolution against PyPI work, including with pip running from the wheel file. - urllib3's test suite passes on both, apart from failures that also happen with upstream 1.26.20 in the same container, and one stale test that ActiveState/urllib3#6 removes.
sha256
pip-26.0.1.post3.tar.gz:aa4836690fb9b6d2b1520ef0001332fceebf21931be736fcbd724853bb55ba92pip-26.0.1.post3-py3-none-any.whl:be55af8fd6e6afe2728f7539eae1ebe00e64264922f740aedfea619847a6e1d0