Description
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pypa | setuptools | < 83.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | setuptools | No fix yet | — |
| Ubuntu 26.04 LTS | setuptools | No fix yet | — |
| Ubuntu 25.10 | setuptools | No fix yet | — |
| Ubuntu 24.04 LTS | setuptools | No fix yet | — |
| Ubuntu 22.04 LTS | setuptools | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | setuptools | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python-setuptools +2 | 83.0.0-4.hum1 | RHSA-2026:37530 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-setuptools | 69.0.3-6 | — |
| Azure Linux 3 | setuptool | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.3.0-r4 | — |
| Wolfi rolling | datadog-agent-7.72 +6 | No fix yet | — |
| Wolfi rolling | datadog-agent-7.73 +1 | 7.73.3-r23 | — |
| Wolfi rolling | datadog-agent-7.77 +1 | 7.77.3-r23 | — |
| Wolfi rolling | datadog-agent-7.78 +1 | 7.78.4-r16 | — |
| Wolfi rolling | datadog-agent-7.79 +1 | 7.79.2-r16 | — |
| Wolfi rolling | datadog-agent-7.80 +1 | 7.80.4-r10 | — |
| Wolfi rolling | httpie | 3.2.4-r13 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | katib-suggestion-hyperopt +6 | 0.19.0-r32 | — |
| Wolfi rolling | kubeflow-jupyter-web-app | 1.10.0-r23 | — |
| Wolfi rolling | kubeflow-volumes-web-app | 1.10.0-r22 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.29.1-r1 | — |
| Wolfi rolling | py3.10-pipenv +3 | 2026.7.1-r1 | — |
| Wolfi rolling | py3.10-setuptools +2 | 83.0.0-r0 | — |
| Wolfi rolling | pypy-3.10 | 7.3.19-r20 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r13 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | setuptools | < 83.0.0 | 83.0.0 | GHSA-h35f-9h28-mq5c |
Advisories 1
- RHSA-2026:37530 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026