PT-2026-28069 · Psf · Requests

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-25645

Mitre

CVSS v3.1

4.4

Medium

AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Requests is a HTTP library. Prior to version 2.33.0, the function requests.utils.extract zipped paths() (which is used by HTTPAdapter.cert verify() to load the CA bundle, often from the certifi package's zipapp structure) uses a predictable, non-unique filename (the basename of the file, e.g., cacert.pem) when attempting to extract files into the system's temporary directory (/tmp). The vulnerable logic performs a check to see if the target file already exists in /tmp and re-uses the existing file if found, instead of securely checking the file's content or ensuring atomic, unique extraction. This allows a Local Attacker to pre-create a malicious CA bundle file (e.g., /tmp/cacert.pem) before a vulnerable application (running with potentially higher privileges) initializes the requests library. Version 2.33.0 contains a patch.

Fix

Weakness Enumeration

CWE-377

Related Identifiers

CVE-2026-25645

Affected Products

Requests

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-25645 · Security Note
• https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7 · Note
• https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2 · Note
• https://github.com/psf/requests/releases/tag/v2.33.0 · Note