Pip Vulnerabilities Lead to Regression and Potential Attacks

On May 29, 2026, Ubuntu announced a regression in pip due to patches for CVE-2025-66471, which were initially intended to fix vulnerabilities in pip on Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. The regression caused issues with TLS certificate verification, potentially allowing remote attackers to perform machine-in-the-middle attacks and expose sensitive information (CVE-2024-35195). Additionally, pip's bundled urllib3 library was found to improperly handle decompression, leading to denial of service vulnerabilities (CVE-2025-66418, CVE-2025-66471). The patches for CVE-2025-66471 have been temporarily reverted pending further investigation. Users are advised to remain vigilant as the vulnerabilities could impact systems using pip for package management.

Key Points: • Pip's regression affects Ubuntu 22.04, 24.04, and 26.04 LTS due to reverted patches. • TLS certificate verification flaws could enable machine-in-the-middle attacks. • Denial of service vulnerabilities exist in pip's urllib3 library, affecting resource consumption.