Skip to content
OpenAdvisories
High ALAS2023-2026-1689 1 CVE

Important: python-pip security update (Amazon Linux 2023)

Published May 11, 2026 · Updated May 15, 2026

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6357: pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2023 python3-pip 0:21.3.1-2.amzn2023.0.19
Amazon Linux · 2023 python3-pip-wheel 0:21.3.1-2.amzn2023.0.19

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-6357.html