Ubuntu Pip Vulnerabilities Lead to Regression and Potential Attacks
Article Content
- •Pip's regression affects Ubuntu 22.04, 24.04, and 26.04 LTS due to reverted patches.
- •TLS certificate verification flaws could enable machine-in-the-middle attacks.
- •Denial of service vulnerabilities exist in pip's urllib3 library, affecting resource consumption.
On May 29, 2026, Ubuntu announced a regression in pip due to patches for CVE-2025-66471, which were initially intended to fix vulnerabilities in pip on Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. The regression caused issues with TLS certificate verification, potentially allowing remote attackers to perform machine-in-the-middle attacks and expose sensitive information (CVE-2024-35195). Additionally, pip's bundled urllib3 library was found to improperly handle decompression, leading to denial of service vulnerabilities (CVE-2025-66418, CVE-2025-66471). The patches for CVE-2025-66471 have been temporarily reverted pending further investigation. Users are advised to remain vigilant as the vulnerabilities could impact systems using pip for package management.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track Ubuntu and CVE-2024-35195 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…