# CVE-2026-25645: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

CVE-2026-25645 is fixed in 8 products on 1 platform, first by python3-requests 2.22.0-2ubuntu1.1+esm2, released March 25, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-25645
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0019
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 25, 2026
- Weakness: Insecure Temporary File
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25645

## Description

Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python-pulp-glue Fedora 43 | 0.37.0-5.fc43 | [FEDORA-2026-8AD863685A](https://patchblox.com/security/data/fix/linux/fedora-2026-8ad863685a.md) | May 8, 2026 |
| Linux | python-requests Fedora 43 | 2.33.1-1.fc43 | [FEDORA-2026-8AD863685A](https://patchblox.com/security/data/fix/linux/fedora-2026-8ad863685a.md) | May 8, 2026 |
| Linux | python-requests opensuse-leap 16.0 | 2.32.4-160000.3.1 | [OPENSUSE-SU-2026:20926-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20926-1.md) | Jun 8, 2026 |
| Linux | python-requests sles 16.0 | 2.32.4-160000.3.1 | [SUSE-SU-2026:22091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22091-1.md) | Jun 8, 2026 |
| Linux | python3-pulp-glue Fedora 43 | 0.37.0-5.fc43 | [FEDORA-2026-8AD863685A](https://patchblox.com/security/data/fix/linux/fedora-2026-8ad863685a.md) | May 8, 2026 |
| Linux | python3-requests Fedora 43 | 2.33.1-1.fc43 | [FEDORA-2026-8AD863685A](https://patchblox.com/security/data/fix/linux/fedora-2026-8ad863685a.md) | May 8, 2026 |
| Linux | python3-requests Ubuntu 20.04 LTS (focal) | 2.22.0-2ubuntu1.1+esm2 | [python3-requests 2.22.0-2ubuntu1.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-requests-2.22.0-2ubuntu1.1-esm2.md) | Mar 25, 2026 |
| Linux | python3-requests Ubuntu 22.04.1 LTS (jammy) | 2.25.1+dfsg-2ubuntu0.4 | [python3-requests 2.25.1+dfsg-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-requests-2.25.1-dfsg-2ubuntu0.4.md) | Mar 25, 2026 |
| Linux | python3-requests Ubuntu 24.04.5 LTS (noble) | 2.31.0+dfsg-1ubuntu1.2 | [python3-requests 2.31.0+dfsg-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-python3-requests-2.31.0-dfsg-1ubuntu1.2.md) | Mar 25, 2026 |
| Linux | python3-requests Ubuntu 26.04.1 LTS (resolute) | 2.32.5+dfsg-1ubuntu1.1 | [python3-requests 2.32.5+dfsg-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-python3-requests-2.32.5-dfsg-1ubuntu1.1.md) | Mar 25, 2026 |
| Linux | python3-requests+security Fedora 43 | 2.33.1-1.fc43 | [FEDORA-2026-8AD863685A](https://patchblox.com/security/data/fix/linux/fedora-2026-8ad863685a.md) | May 8, 2026 |
| Linux | python3-requests+socks Fedora 43 | 2.33.1-1.fc43 | [FEDORA-2026-8AD863685A](https://patchblox.com/security/data/fix/linux/fedora-2026-8ad863685a.md) | May 8, 2026 |
| Linux | python3-requests+use_chardet_on_py3 Fedora 43 | 2.33.1-1.fc43 | [FEDORA-2026-8AD863685A](https://patchblox.com/security/data/fix/linux/fedora-2026-8ad863685a.md) | May 8, 2026 |
| Linux | requests Debian 14 | 2.34.2-1 | [DEBIAN-CVE-2026-25645](https://patchblox.com/security/data/fix/linux/debian-cve-2026-25645.md) | Mar 25, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.