{"id":"CVE-2026-25645","title":"requests: Requests: Security bypass due to predictable temporary file creation (CVE-2026-25645)","summary":"A flaw was found in the `requests` HTTP library, specifically in the `requests.utils.extract_zipped_paths()` function, which is used to load Certificate Authority (CA) bundles. A local attacker can exploit this vulnerability by pre-creatin…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","cwe":"CWE-379","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["external_secrets_operator_for_red_hat_openshift","lightspeed_core","logging_subsystem_for_red_hat_openshift","migration_toolkit_for_containers","migration_toolkit_for_virtualization","openshift_lightspeed","openshift_service_mesh 3","pen_drive_powered_by_red_hat_lightspeed","ai_inference_server","ansible_automation_platform 2","ansible_automation_platform_ansible_core 2","build_of_quarkus_native_builder","developer_hub","discovery 2","enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","quay 3","satellite 6","trusted_artifact_signer","service_telemetry_framework 1.5","ai_inference_server 3.4","enterprise_linux_ai 3.4","openshift_data_foundation 4.18"],"patched":["ai_inference_server 3.4","enterprise_linux_ai 3.4","openshift_data_foundation 4.18"],"published":"2026-03-25","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:33:56+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25645.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25645.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-25645"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451408"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25645"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"url":"https://github.com/psf/requests/releases/tag/v2.33.0"},{"url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"url":"https://access.redhat.com/errata/RHSA-2026:57383"},{"url":"https://access.redhat.com/errata/RHSA-2026:59151"},{"url":"https://access.redhat.com/errata/RHSA-2026:59144"},{"url":"https://access.redhat.com/errata/RHSA-2026:56431"},{"url":"https://github.com/psf/requests"}],"tags":["csaf","vex","red-hat","exploit-available","osv","pip"],"epss":0.00189,"epssPercentile":0.08493,"exploits":{"github":1,"githubRepos":["https://github.com/Jaycelation/CVE-2026-25645"],"checkedAt":"2026-10-27T17:03:13.390Z"},"exploitAvailable":true,"aliases":["GHSA-gc5v-m9x4-r6x2","PYSEC-2026-2275"],"ecosystem":"pip","scores":{"vendor":4.7,"osv":4.4},"ingestedAt":"2026-07-13T18:57:58.243Z","slug":"CVE-2026-25645","body":"## Overview\n\nA flaw was found in the `requests` HTTP library, specifically in the `requests.utils.extract_zipped_paths()` function, which is used to load Certificate Authority (CA) bundles. A local attacker can exploit this vulnerability by pre-creating a malicious CA bundle file in the system's temporary directory. When a vulnerable application initializes the `requests` library, it may load this malicious file instead of the legitimate CA bundle, leading to a bypass of security controls and potential integrity compromise.\n\n## Vendor advisories\n\n- **RHSA-2026:57383** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57383)\n- **RHSA-2026:59151** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.4 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59151)\n- **RHSA-2026:59144** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.4 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59144)\n- **RHSA-2026:56431** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.18 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56431)\n- **Red Hat VEX** · Moderate · affected: External Secrets Operator for Red Hat OpenShift, Lightspeed Core, Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Containers, Migration Toolkit for Virtualization, OpenShift Lightspeed, … · no fix planned: External Secrets Operator for Red Hat OpenShift, Lightspeed Core, Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Containers, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25645.json)\n\n**requests: Requests: Security bypass due to predictable temporary file creation** — rated Moderate by Red Hat. Released 2026-03-25, updated 2026-10-15.\n\nAffected:\n\n- External Secrets Operator for Red Hat OpenShift\n- Lightspeed Core\n- Logging Subsystem for Red Hat OpenShift\n- Migration Toolkit for Containers\n- Migration Toolkit for Virtualization\n- OpenShift Lightspeed\n- OpenShift Service Mesh 3\n- Pen Drive Powered by Red Hat Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat build of Quarkus Native builder\n- Red Hat Developer Hub\n- Red Hat Discovery 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Quay 3\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n- Service Telemetry Framework 1.5\n\nFixed:\n\n- Red Hat AI Inference Server 3.4\n- Red Hat Enterprise Linux AI 3.4\n- Red Hat Openshift Data Foundation 4.18\n\nNo fix planned:\n\n- External Secrets Operator for Red Hat OpenShift\n- Lightspeed Core\n- Logging Subsystem for Red Hat OpenShift\n- Migration Toolkit for Containers\n- Migration Toolkit for Virtualization\n- OpenShift Lightspeed\n- OpenShift Service Mesh 3\n- Pen Drive Powered by Red Hat Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat build of Quarkus Native builder\n- Red Hat Developer Hub\n- Red Hat Discovery 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Quay 3\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n- Service Telemetry Framework 1.5\n\nNot affected:\n\n- Red Hat Enterprise Linux AI 3.4\n- Red Hat Openshift Data Foundation 4.18\n\n## Remediation\n\nFor more information visit https://access.redhat.com/errata/RHSA-2026:57383 https://access.redhat.com/errata/RHSA-2026:57383\nThe container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.\n\nFor details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.4 https://access.redhat.com/errata/RHSA-2026:59151\nThe container disk images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command, for use with OpenShift Virtualization.\n\nFor details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.4 https://access.redhat.com/errata/RHSA-2026:59144\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-25645)\n\nAffected packages:\n\n- `requests < 2.33.0`\n\nPatched in:\n\n- `requests 2.33.0`\n\nSource: https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2","depth":"twilight","depthScore":38,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":222191,"id":"CVE-2026-25645","ts":1792065059821,"field":"cvss","old":"4.4","new":"4.7"},{"seq":201481,"id":"CVE-2026-25645","ts":1789399492779,"field":"exploit_available","old":"false","new":"true"},{"seq":200215,"id":"CVE-2026-25645","ts":1789397052361,"field":"exploit_available","old":"true","new":"false"},{"seq":198139,"id":"CVE-2026-25645","ts":1789391726395,"field":"exploit_available","old":"false","new":"true"},{"seq":195932,"id":"CVE-2026-25645","ts":1789383380191,"field":"exploit_available","old":"true","new":"false"},{"seq":194861,"id":"CVE-2026-25645","ts":1789380297174,"field":"exploit_available","old":"false","new":"true"},{"seq":193648,"id":"CVE-2026-25645","ts":1789378245568,"field":"exploit_available","old":"true","new":"false"},{"seq":192435,"id":"CVE-2026-25645","ts":1789376217677,"field":"exploit_available","old":"false","new":"true"},{"seq":191222,"id":"CVE-2026-25645","ts":1789373106230,"field":"exploit_available","old":"true","new":"false"},{"seq":190007,"id":"CVE-2026-25645","ts":1789369118247,"field":"exploit_available","old":"false","new":"true"},{"seq":188794,"id":"CVE-2026-25645","ts":1789368032839,"field":"exploit_available","old":"true","new":"false"},{"seq":187577,"id":"CVE-2026-25645","ts":1789364986804,"field":"exploit_available","old":"false","new":"true"},{"seq":186364,"id":"CVE-2026-25645","ts":1789362973549,"field":"exploit_available","old":"true","new":"false"},{"seq":185150,"id":"CVE-2026-25645","ts":1789360957992,"field":"exploit_available","old":"false","new":"true"},{"seq":183937,"id":"CVE-2026-25645","ts":1789357913736,"field":"exploit_available","old":"true","new":"false"},{"seq":182189,"id":"CVE-2026-25645","ts":1789354081173,"field":"exploit_available","old":"false","new":"true"},{"seq":180982,"id":"CVE-2026-25645","ts":1789352931455,"field":"exploit_available","old":"true","new":"false"},{"seq":179775,"id":"CVE-2026-25645","ts":1789349983438,"field":"exploit_available","old":"false","new":"true"},{"seq":178568,"id":"CVE-2026-25645","ts":1789347776922,"field":"exploit_available","old":"true","new":"false"},{"seq":177361,"id":"CVE-2026-25645","ts":1789346169141,"field":"exploit_available","old":"false","new":"true"},{"seq":176154,"id":"CVE-2026-25645","ts":1789342719851,"field":"exploit_available","old":"true","new":"false"},{"seq":175938,"id":"CVE-2026-25645","ts":1789342331791,"field":"exploit_available","old":"false","new":"true"},{"seq":175478,"id":"CVE-2026-25645","ts":1789338372391,"field":"exploit_available","old":"true","new":"false"},{"seq":174273,"id":"CVE-2026-25645","ts":1789334587781,"field":"exploit_available","old":"false","new":"true"},{"seq":173068,"id":"CVE-2026-25645","ts":1789333195601,"field":"exploit_available","old":"true","new":"false"},{"seq":171882,"id":"CVE-2026-25645","ts":1789330875117,"field":"exploit_available","old":"false","new":"true"},{"seq":170696,"id":"CVE-2026-25645","ts":1789328376238,"field":"exploit_available","old":"true","new":"false"},{"seq":169491,"id":"CVE-2026-25645","ts":1789326897778,"field":"exploit_available","old":"false","new":"true"},{"seq":168286,"id":"CVE-2026-25645","ts":1789323414384,"field":"exploit_available","old":"true","new":"false"},{"seq":167081,"id":"CVE-2026-25645","ts":1789319359067,"field":"exploit_available","old":"false","new":"true"},{"seq":165876,"id":"CVE-2026-25645","ts":1789318255868,"field":"exploit_available","old":"true","new":"false"},{"seq":164671,"id":"CVE-2026-25645","ts":1789315528967,"field":"exploit_available","old":"false","new":"true"},{"seq":163466,"id":"CVE-2026-25645","ts":1789313244305,"field":"exploit_available","old":"true","new":"false"},{"seq":162261,"id":"CVE-2026-25645","ts":1789311709214,"field":"exploit_available","old":"false","new":"true"},{"seq":161056,"id":"CVE-2026-25645","ts":1789308247690,"field":"exploit_available","old":"true","new":"false"},{"seq":160561,"id":"CVE-2026-25645","ts":1789304187915,"field":"exploit_available","old":"false","new":"true"},{"seq":158399,"id":"CVE-2026-25645","ts":1789299258997,"field":"exploit_available","old":"true","new":"false"},{"seq":157363,"id":"CVE-2026-25645","ts":1789296455949,"field":"exploit_available","old":"false","new":"true"},{"seq":156158,"id":"CVE-2026-25645","ts":1789294362295,"field":"exploit_available","old":"true","new":"false"},{"seq":154953,"id":"CVE-2026-25645","ts":1789292629794,"field":"exploit_available","old":"false","new":"true"},{"seq":153748,"id":"CVE-2026-25645","ts":1789289334344,"field":"exploit_available","old":"true","new":"false"},{"seq":152960,"id":"CVE-2026-25645","ts":1789285237200,"field":"exploit_available","old":"false","new":"true"},{"seq":152204,"id":"CVE-2026-25645","ts":1789280951801,"field":"exploit_available","old":"true","new":"false"},{"seq":151165,"id":"CVE-2026-25645","ts":1789277447804,"field":"exploit_available","old":"false","new":"true"},{"seq":147894,"id":"CVE-2026-25645","ts":1789270867918,"field":"exploit_available","old":"true","new":"false"},{"seq":145934,"id":"CVE-2026-25645","ts":1789269172155,"field":"exploit_available","old":"false","new":"true"},{"seq":144837,"id":"CVE-2026-25645","ts":1789266102768,"field":"exploit_available","old":"true","new":"false"},{"seq":143741,"id":"CVE-2026-25645","ts":1789262438289,"field":"exploit_available","old":"false","new":"true"},{"seq":142577,"id":"CVE-2026-25645","ts":1789261175664,"field":"exploit_available","old":"true","new":"false"},{"seq":141413,"id":"CVE-2026-25645","ts":1789258608424,"field":"exploit_available","old":"false","new":"true"}]}