Summary
USN-8344-1 introduced a regression in pip. This update provides a complete fix for this issue..
We apologize for the inconvenience.
Original advisory details:
It was discovered that pip's bundled urllib3 library improperly
handled streaming decompression of highly compressed data. A remote
attacker could possibly use this issue to cause pip to consume excessive resources,
leading to a denial of service. (CVE-2025-66471)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python-pip | 22.0.2+dfsg-1ubuntu0.7+esm3 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | python-pip | 24.0+dfsg-1ubuntu1.3+esm3 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | python-pip | 25.1.1+dfsg-1ubuntu2+esm3 |
Vulnerabilities 1
-
High 8.9
urllib3 Streaming API improperly handles highly compressed data
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by readi…
References
-
report
https://ubuntu.com/security/CVE-2025-66471