Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-44919b3d9f advisory.

    2.33.1 (2026-03-30)
    -------------------

    **Bugfixes**
    - Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary       files in the tmp directory.
    - Fixed Content-Type header parsing for malformed values.
    - Improved error consistency for malformed header values.

    2.33.0 (2026-03-25)
    -------------------

    **Announcements**
    -  Requests is adding inline types. If you have a typed code base that     uses Requests, please take a look at     [#7271](https://github.com/psf/requests/issues/7271).
    Give it a try, and report any gaps or feedback you may have in the issue. 

    **Security**
    - [CVE-2026-25645](https://www.cve.org/CVERecord?id=CVE-2026-25645)       `requests.utils.extract_zipped_paths` now extracts       contents to a non-deterministic location to prevent malicious file       replacement. This does not affect default usage of Requests, only       applications calling the utility function directly.

    **Improvements**
    - Migrated to a PEP 517 build system using setuptools.

    **Bugfixes**
    - Fixed an issue where an empty netrc entry could cause       malformed authentication to be applied to Requests on       Python 3.11+.

    **Deprecations**
    - Dropped support for Python 3.9 following its end of support.

    **Documentation**
    - Various typo fixes and doc improvements.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1647-1 advisory.

    - CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip     archives and       reuses target files that already exist without validation (bsc#1260589).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1644-1 advisory.

    - CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip     archives and       reuses target files that already exist without validation (bsc#1260589).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fdc024ddc3 advisory.

    JIT translation fix for bootstraping, require openssl 3 and fix CVE-2026-25645 and CVE-2025-8869

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2af3865ebf advisory.

    JIT translation fix for bootstraping, require openssl 3 and fix CVE-2026-25645 and CVE-2025-8869

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ae330775b9 advisory.

    JIT translation fix for bootstraping, require openssl 3 and fix CVE-2026-25645 and CVE-2025-8869


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1218-1 advisory.

    - CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip     archives and       reuses target files that already exist without validation (bsc#1260589).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-25645 advisory.

  - Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access. (CVE-2026-25645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility     function uses a predictable filename when extracting files from zip archives into the system temporary     directory. If the target file already exists, it is reused without validation. A local attacker with write     access to the temp directory could pre-create a malicious file that would be loaded in place of the     legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only     applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the     library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set     `TMPDIR` in their environment to a directory with restricted write access. (CVE-2026-25645)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
313663	Fedora 44 : python-pulp-glue / python-requests (2026-44919b3d9f)	Nessus	Fedora Local Security Checks	medium
311758	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-requests (SUSE-SU-2026:1647-1)	Nessus	SuSE Local Security Checks	medium
311752	SUSE SLED15 / SLES15 Security Update : python-requests (SUSE-SU-2026:1644-1)	Nessus	SuSE Local Security Checks	medium
310210	Fedora 44 : pypy (2026-fdc024ddc3)	Nessus	Fedora Local Security Checks	medium
306611	Fedora 43 : pypy (2026-2af3865ebf)	Nessus	Fedora Local Security Checks	medium
306477	Fedora 45 : pypy (2026-ae330775b9)	Nessus	Fedora Local Security Checks	medium
305683	SUSE SLES12 Security Update : python-requests (SUSE-SU-2026:1218-1)	Nessus	SuSE Local Security Checks	medium
305118	Photon OS 5.0: Python3 PHSA-2026-5.0-0802	Nessus	PhotonOS Local Security Checks	critical
304402	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-25645)	Nessus	Azure Linux Local Security Checks	medium
303843	Linux Distros Unpatched Vulnerability : CVE-2026-25645	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-25645

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium