Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2af3865ebf advisory.

    JIT translation fix for bootstraping, require openssl 3 and fix CVE-2026-25645 and CVE-2025-8869

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ae330775b9 advisory.

    JIT translation fix for bootstraping, require openssl 3 and fix CVE-2026-25645 and CVE-2025-8869


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1218-1 advisory.

    - CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip     archives and       reuses target files that already exist without validation (bsc#1260589).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-25645 advisory.

  - Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access. (CVE-2026-25645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access. (CVE-2026-25645)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306611	Fedora 43 : pypy (2026-2af3865ebf)	Nessus	Fedora Local Security Checks	medium
306477	Fedora 45 : pypy (2026-ae330775b9)	Nessus	Fedora Local Security Checks	medium
305683	SUSE SLES12 Security Update : python-requests (SUSE-SU-2026:1218-1)	Nessus	SuSE Local Security Checks	medium
305118	Photon OS 5.0: Python3 PHSA-2026-5.0-0802	Nessus	PhotonOS Local Security Checks	critical
304402	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-25645)	Nessus	Azure Linux Local Security Checks	medium
303843	Linux Distros Unpatched Vulnerability : CVE-2026-25645	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-25645

medium

Tenable Plugins

medium

medium

medium

critical

medium

medium