SBOM for virtualenv 21.15.6
Virtual Python Environment builder
Package information
Available SBOMs
Read from .dist-info/sboms/ in each wheel.
virtualenv-21.15.6-py3-none-any.whl
Attested
Valid
Download
virtualenv.cdx.json
CycloneDX/1.6
application/vnd.cyclonedx+json
22 known vulnerabilities
Known vulnerabilities
Components listed in these SBOMs, matched against the OSV database as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in |
|---|---|---|---|
|
PYSEC-2026-4320
certifi bundles emSign root CAs with compromised intermediate CA keys
|
Critical 9.1 | certifi 2026.1.4 PyPI |
2026.10.18 |
|
CVE-2025-66418
urllib3 allows an unbounded number of links in the decompression chain
|
High 8.9 | urllib3 1.26.20 PyPI |
2.6.0 |
|
CVE-2025-66471
urllib3 streaming API improperly handles highly compressed data
|
High 8.9 | urllib3 1.26.20 PyPI |
2.6.0 |
|
CVE-2026-21441
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
|
High 8.9 | urllib3 1.26.20 PyPI |
2.6.3 |
|
CVE-2026-97689
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
|
High 8.9 | urllib3 1.26.20 PyPI |
2.8.0 |
|
CVE-2025-47273
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
|
High 8.8 | setuptools 70.3.0 PyPI |
78.1.1 |
|
CVE-2026-44431
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
|
High 8.2 | urllib3 1.26.20 PyPI |
2.7.0 |
|
CVE-2026-8643
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
|
High 8.0 | pip 26.0.1 PyPI |
26.1.2 |
|
CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
|
High 7.6 | urllib3 1.26.20 PyPI |
2.8.0 |
|
CVE-2026-114613
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
|
High 7.5 | msgpack 1.1.2 PyPI |
1.2.3 |
|
CVE-2026-57585
MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
|
High 7.5 | msgpack 1.1.2 PyPI |
1.2.1 |
|
CVE-2026-45409
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
|
Medium 6.9 | idna 3.11 PyPI |
3.15 |
|
CVE-2026-13346
pip would incorrectly handle doubly-encoded package URLs from indexes
|
Medium 6.5 | pip 26.0.1 PyPI |
26.2, 26.2.0 |
|
CVE-2026-59890
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
|
Medium 6.1 | setuptools 70.3.0 PyPI |
83.0.0 |
|
CVE-2026-59890
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
|
Medium 6.1 | setuptools 82.0.1 PyPI |
83.0.0 |
|
CVE-2026-25645
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
|
Medium 5.5 | requests 2.32.5 PyPI |
2.33.0 |
|
CVE-2026-6357
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
|
Medium 5.3 | pip 26.0.1 PyPI |
26.1 |
|
CVE-2025-50181
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
|
Medium 5.3 | urllib3 1.26.20 PyPI |
2.5.0 |
|
CVE-2026-3219
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
|
Medium 4.6 | pip 26.0.1 PyPI |
26.1 |
|
CVE-2026-4539
Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
|
Low 3.3 | pygments 2.19.2 PyPI |
2.20.0 |
|
GHSA-xmj3-9gf7-h52w
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
|
Low 1.0 | setuptools 70.3.0 PyPI |
84.1.0 |
|
GHSA-xmj3-9gf7-h52w
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
|
Low 1.0 | setuptools 82.0.1 PyPI |
84.1.0 |
Access via TEA
Use the Transparency Exchange API to fetch this SBOM programmatically:
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]