CVE-2024-35195 — Requests `Session` object does not verify requests after making first request with verify=False

Affected: psf requests, request_project request

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

USN-8344-1 — python-pip vulnerabilities

Affected: Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:Pro:24.04:LTS: python-pip, Ubuntu:Pro:26.04:LTS: python-pip

It was discovered that pip incorrectly handled TLS certificate verification in session connections. If a session was first used with certificate verification disabled, subsequent requests to the same host would also skip verification regardless of the session's current settings. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and expose sensitive information. (CVE-2024-35195)

It was discovered that pip's bundled urllib3 library did not limit the number of decompression steps when processing HTTP responses. A remote attacker could possibly use this issue to cause pip to consume excessive resources, leading to a denial of service. (CVE-2025-66418)

It was discovered that pip's bundled urllib3 library improperly handled streaming decompression of highly compressed data. A remote attacker could possibly use this issue to cause pip to consume excessive resources, leading to a denial of service. (CVE-2025-66471)

Most recent entries from all

CVE-2024-35195 — Requests `Session` object does not verify requests after making first request with verify=False

USN-8344-1 — python-pip vulnerabilities