CVE-2026-6357

EUVD-2026-25857

27.04.2026, 15:16

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 3.55%

Debian Releases

Debian Product

Codename

python-pip

bookworm	no-dsa
bullseye	postponed
forky	26.1.2+dfsg-1 fixed
sid	26.1.2+dfsg-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

python-pip

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage
trusty	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libpython2_7-1_0

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.2 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

libpython2_7-1_0-32bit

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.2 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

libpython3_4m1_0

suse enterprise sap 12 SP5	3.4.10-25.191.2 fixed
suse enterprise server 12 SP3	3.4.10-25.191.2 fixed
suse enterprise server 12 SP5	3.4.10-25.191.2 fixed

libpython3_4m1_0-32bit

suse enterprise sap 12 SP5	3.4.10-25.191.2 fixed
suse enterprise server 12 SP5	3.4.10-25.191.2 fixed

libpython3_6m1_0

suse enterprise sap 12 SP5	3.6.15-116.1 fixed
suse enterprise server 12 SP3	3.6.15-6.159.1 fixed
suse enterprise server 12 SP5	3.6.15-116.1 fixed

libpython3_6m1_0-32bit

suse enterprise sap 12 SP5	3.6.15-116.1 fixed
suse enterprise server 12 SP5	3.6.15-116.1 fixed

python

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.1 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-32bit

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.1 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-base

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.2 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-base-32bit

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.2 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-curses

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.1 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-demo

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.1 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-devel

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.2 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-doc

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.1 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-doc-pdf

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.1 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-gdbm

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.1 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-idle

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.1 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-pip

suse enterprise sap 12 SP5	10.0.1-13.20.1 fixed
suse enterprise server 12 SP5	10.0.1-13.20.1 fixed

python-tk

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.1 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python-xml

suse enterprise sap 12 SP5	2.7.18-33.82.1 fixed
suse enterprise server 12 SP3	2.7.18-28.162.2 fixed
suse enterprise server 12 SP5	2.7.18-33.82.1 fixed

python3

suse enterprise sap 12 SP5	3.4.10-25.191.2 fixed
suse enterprise server 12 SP3	3.4.10-25.191.2 fixed
suse enterprise server 12 SP5	3.4.10-25.191.2 fixed

python3-base

suse enterprise sap 12 SP5	3.4.10-25.191.2 fixed
suse enterprise server 12 SP3	3.4.10-25.191.2 fixed
suse enterprise server 12 SP5	3.4.10-25.191.2 fixed

python3-curses

suse enterprise sap 12 SP5	3.4.10-25.191.2 fixed
suse enterprise server 12 SP3	3.4.10-25.191.2 fixed
suse enterprise server 12 SP5	3.4.10-25.191.2 fixed

python3-devel

suse enterprise sap 12 SP5	3.4.10-25.191.2 fixed
suse enterprise server 12 SP5	3.4.10-25.191.2 fixed

python3-pip

suse enterprise sap 12 SP5	10.0.1-13.20.1 fixed
suse enterprise server 12 SP5	10.0.1-13.20.1 fixed

python3-tk

suse enterprise sap 12 SP5	3.4.10-25.191.2 fixed
suse enterprise server 12 SP5	3.4.10-25.191.2 fixed

python36

suse enterprise sap 12 SP5	3.6.15-116.1 fixed
suse enterprise server 12 SP3	3.6.15-6.159.1 fixed
suse enterprise server 12 SP5	3.6.15-116.1 fixed

python36-base

suse enterprise sap 12 SP5	3.6.15-116.1 fixed
suse enterprise server 12 SP3	3.6.15-6.159.1 fixed
suse enterprise server 12 SP5	3.6.15-116.1 fixed

python36-curses

suse enterprise server 12 SP3

3.6.15-6.159.1

fixed

python36-dbm

suse enterprise server 12 SP3

3.6.15-6.159.1

fixed

python36-devel

suse enterprise sap 12 SP5	3.6.15-116.1 fixed
suse enterprise server 12 SP3	3.6.15-6.159.1 fixed
suse enterprise server 12 SP5	3.6.15-116.1 fixed

python36-idle

suse enterprise server 12 SP3

3.6.15-6.159.1

fixed

python36-testsuite

suse enterprise server 12 SP3

3.6.15-6.159.1

fixed

python36-tk

suse enterprise server 12 SP3

3.6.15-6.159.1

fixed

python36-tools

suse enterprise server 12 SP3

3.6.15-6.159.1

fixed

Amazon Linux Releases

Amazon Package

Release

python-pip-wheel

Amazon Linux 2

0:20.2.2-1.amzn2.0.17

fixed

python2-pip

Amazon Linux 2

0:20.2.2-1.amzn2.0.17

fixed

python3-pip

Amazon Linux 2	0:20.2.2-1.amzn2.0.17 fixed
Amazon Linux 2023	0:21.3.1-2.amzn2023.0.19 fixed

python3-pip-wheel

Amazon Linux 2023

0:21.3.1-2.amzn2023.0.19

fixed

python3.11-pip

Amazon Linux 2023

0:22.3.1-2.amzn2023.0.12

fixed

python3.11-pip-wheel

Amazon Linux 2023

0:22.3.1-2.amzn2023.0.12

fixed

python3.12-pip

Amazon Linux 2023

0:23.2.1-4.amzn2023.0.9

fixed

python3.12-pip-wheel

Amazon Linux 2023

0:23.2.1-4.amzn2023.0.9

fixed

python3.13-pip

Amazon Linux 2023

0:24.2-259.amzn2023.0.5

fixed

python3.13-pip-wheel

Amazon Linux 2023

0:24.2-259.amzn2023.0.5

fixed

python3.14-pip

Amazon Linux 2023

0:25.1.1-1.amzn2023.0.2

fixed

python3.14-pip-wheel

Amazon Linux 2023

0:25.1.1-1.amzn2023.0.2

fixed

Azure Linux Releases

Azure Package

Release

python-pip

Azure Linux 3.0

0:24.2-8.azl3

fixed

python-virtualenv

Azure Linux 3.0

0:20.36.1-4.azl3

fixed

Common Weakness Enumeration

CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

References

https://github.com/pypa/pip/pull/13923

https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes

http://www.openwall.com/lists/oss-security/2026/04/27/7