uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on some package installers, and malicious contents on others due to multiple local file entries. An attacker could also contrive a "stacked" ZIP input with multiple internal ZIPs, which would be handled differently by different package installers. The attacker could choose which installer to target in both scenarios. This issue is fixed in version 0.8.6. To work around this issue, users may choose to set UV_INSECURE_NO_ZIP_VALIDATION=1 to revert to the previous behavior.

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-c22dd590b8 advisory.

    - Update uv to version 0.8.8.
    - Update the h2 crate to version 0.4.12.

    The builds in this update also address CVE-2025-54368.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-92fd810e1d advisory.

    - Update uv to version 0.8.8.
    - Update the h2 crate to version 0.4.12.

    The builds in this update also address CVE-2025-54368.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-8628ba80b1 advisory.

    - Update uv and python-uv-build to version 0.8.8.
    - Update the h2 crate to version 0.4.12.

    The builds in this update also address CVE-2025-54368.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP
    archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's
    central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on
    some package installers, and malicious contents on others due to multiple local file entries. An attacker
    could also contrive a "stacked" ZIP input with multiple internal ZIPs, which would be handled differently
    by different package installers. The attacker could choose which installer to target in both scenarios.
    This issue is fixed in version 0.8.6. To work around this issue, users may choose to set
    UV_INSECURE_NO_ZIP_VALIDATION=1 to revert to the previous behavior. (CVE-2025-54368)

ID	Name	Product	Family	Severity
252268	Fedora 42 : rust-h2 / uv (2025-c22dd590b8)	Nessus	Fedora Local Security Checks	medium
252265	Fedora 41 : rust-h2 / uv (2025-92fd810e1d)	Nessus	Fedora Local Security Checks	medium
247745	Fedora 43 : python-uv-build / rust-h2 / uv (2025-8628ba80b1)	Nessus	Fedora Local Security Checks	medium
432557	SCA: security update for uv (GHSA-8qf3-x8v5-2pj8)	Tenable Cloud Security	SCA Checks	medium
432557	SCA: security update for uv (GHSA-8qf3-x8v5-2pj8)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-54368

medium

Tenable Plugins

medium

medium

medium

medium

medium