pip self-update functionality can import newly installed modules after wheel installation
CVE-2026-6357 is fixed in 15 products on 1 platform, first by DEBIAN-CVE-2026-6357, released April 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| python · sles 15.7 | 2.7.18-150000.123.1 | SUSE-SU-2026:3635-1 | Aug 18, 2026 |
| python-base · sles 15.7 | 2.7.18-150000.123.1 | SUSE-SU-2026:3635-1 | Aug 18, 2026 |
| python-pip · Debian 14 | 26.1.1+dfsg-1 | DEBIAN-CVE-2026-6357 | Apr 27, 2026 |
| python-pip · sles 15.6 | 22.3.1-150400.17.26.1 | SUSE-SU-2026:2634-1 | Jun 25, 2026 |
| python-pip · sles 15.7 | 22.3.1-150400.17.26.1 | SUSE-SU-2026:2634-1 | Jun 25, 2026 |
| python-pip · sles 16.0 | 25.0.1-160000.4.1 | SUSE-SU-2026:22018-1 | Jun 2, 2026 |
| python3 · sles 15.6 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3 · sles 15.7 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3-core · sles 15.6 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3-core · sles 15.7 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3-pip · amzn 2023 | 21.3.1-2.amzn2023.0.19 | ALAS2023-2026-1689 | May 11, 2026 |
| python3-pip-wheel · amzn 2023 | 21.3.1-2.amzn2023.0.19 | ALAS2023-2026-1689 | May 11, 2026 |
| python3.11-pip · amzn 2023 | 22.3.1-2.amzn2023.0.12 | ALAS2023-2026-1665 | May 11, 2026 |
| python3.11-pip-wheel · amzn 2023 | 22.3.1-2.amzn2023.0.12 | ALAS2023-2026-1665 | May 11, 2026 |
| python3.12-pip · amzn 2023 | 23.2.1-4.amzn2023.0.9 | ALAS2023-2026-1666 | May 11, 2026 |
| python3.12-pip-wheel · amzn 2023 | 23.2.1-4.amzn2023.0.9 | ALAS2023-2026-1666 | May 11, 2026 |
| python3.13-pip · amzn 2023 | 24.2-259.amzn2023.0.5 | ALAS2023-2026-1654 | May 11, 2026 |
| python3.13-pip-wheel · amzn 2023 | 24.2-259.amzn2023.0.5 | ALAS2023-2026-1654 | May 11, 2026 |
| python3.14-pip · amzn 2023 | 25.1.1-1.amzn2023.0.2 | ALAS2023-2026-1653 | May 11, 2026 |
| python3.14-pip-wheel · amzn 2023 | 25.1.1-1.amzn2023.0.2 | ALAS2023-2026-1653 | May 11, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.