# SBOM for virtualenv 21.15.6 > Virtual Python Environment builder The Python package virtualenv 21.15.6 ships 1 SBOM file (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/virtualenv@21.15.6` - PyPI: https://pypi.org/project/virtualenv/21.15.6/ - Requires Python: \>=3.9 - Changelog: - Documentation: - Funding: - Homepage: - Source: - Tidelift: - Tracker: - thanks.dev: ## SBOMs ### virtualenv-21.15.6-py3-none-any.whl PEP 740 attestation verified (GitHub, pypa/virtualenv, workflow release.yaml). - [virtualenv-21.15.6.dist-info/sboms/virtualenv.cdx.json](https://pypi.sbomify.com/artifact/41ea754e-1700-5438-addc-40c94dfb6d58/download): CycloneDX/1.6, `application/vnd.cyclonedx+json`, valid, 22 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [PYSEC-2026-4320](https://osv.dev/vulnerability/PYSEC-2026-4320) | critical (9.1) | certifi 2026.1.4 (PyPI) | 2026.10.18 | certifi bundles emSign root CAs with compromised intermediate CA keys | | [CVE-2025-66418](https://insights.sbomify.com/CVE-2025-66418/) | high (8.9) | urllib3 1.26.20 (PyPI) | 2.6.0 | urllib3 allows an unbounded number of links in the decompression chain | | [CVE-2025-66471](https://insights.sbomify.com/CVE-2025-66471/) | high (8.9) | urllib3 1.26.20 (PyPI) | 2.6.0 | urllib3 streaming API improperly handles highly compressed data | | [CVE-2026-21441](https://insights.sbomify.com/CVE-2026-21441/) | high (8.9) | urllib3 1.26.20 (PyPI) | 2.6.3 | Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) | | [CVE-2026-97689](https://insights.sbomify.com/CVE-2026-97689/) | high (8.9) | urllib3 1.26.20 (PyPI) | 2.8.0 | urllib3: HTTPResponse.stream()/read\_chunked() buffers an unbounded chunk-size line into memory | | [CVE-2025-47273](https://insights.sbomify.com/CVE-2025-47273/) | high (8.8) | setuptools 70.3.0 (PyPI) | 78.1.1 | setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write | | [CVE-2026-44431](https://insights.sbomify.com/CVE-2026-44431/) | high (8.2) | urllib3 1.26.20 (PyPI) | 2.7.0 | urllib3: Sensitive headers forwarded across origins in proxied low-level redirects | | [CVE-2026-8643](https://insights.sbomify.com/CVE-2026-8643/) | high (8.0) | pip 26.0.1 (PyPI) | 26.1.2 | pip: Path traversal in console\_scripts/gui\_scripts entry point names allows installing scripts outside of target directory | | [CVE-2026-97687](https://insights.sbomify.com/CVE-2026-97687/) | high (7.6) | urllib3 1.26.20 (PyPI) | 2.8.0 | urllib3: HTTPS proxy TLS configuration may be ignored or overridden | | [CVE-2026-114613](https://insights.sbomify.com/CVE-2026-114613/) | high (7.5) | msgpack 1.1.2 (PyPI) | 1.2.3 | MessagePack: Unbounded memory leak in msgpack C extension on strict\_map\_key validation failure | | [CVE-2026-57585](https://insights.sbomify.com/CVE-2026-57585/) | high (7.5) | msgpack 1.1.2 (PyPI) | 1.2.1 | MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error | | [CVE-2026-45409](https://insights.sbomify.com/CVE-2026-45409/) | medium (6.9) | idna 3.11 (PyPI) | 3.15 | Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix | | [CVE-2026-13346](https://insights.sbomify.com/CVE-2026-13346/) | medium (6.5) | pip 26.0.1 (PyPI) | 26.2, 26.2.0 | pip would incorrectly handle doubly-encoded package URLs from indexes | | [CVE-2026-59890](https://insights.sbomify.com/CVE-2026-59890/) | medium (6.1) | setuptools 70.3.0 (PyPI) | 83.0.0 | setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ | | [CVE-2026-59890](https://insights.sbomify.com/CVE-2026-59890/) | medium (6.1) | setuptools 82.0.1 (PyPI) | 83.0.0 | setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ | | [CVE-2026-25645](https://insights.sbomify.com/CVE-2026-25645/) | medium (5.5) | requests 2.32.5 (PyPI) | 2.33.0 | Requests has Insecure Temp File Reuse in its extract\_zipped\_paths() utility function | | [CVE-2026-6357](https://insights.sbomify.com/CVE-2026-6357/) | medium (5.3) | pip 26.0.1 (PyPI) | 26.1 | pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere | | [CVE-2025-50181](https://insights.sbomify.com/CVE-2025-50181/) | medium (5.3) | urllib3 1.26.20 (PyPI) | 2.5.0 | urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation | | [CVE-2026-3219](https://insights.sbomify.com/CVE-2026-3219/) | medium (4.6) | pip 26.0.1 (PyPI) | 26.1 | pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files | | [CVE-2026-4539](https://insights.sbomify.com/CVE-2026-4539/) | low (3.3) | pygments 2.19.2 (PyPI) | 2.20.0 | Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching | | [GHSA-xmj3-9gf7-h52w](https://osv.dev/vulnerability/GHSA-xmj3-9gf7-h52w) | low (1.0) | setuptools 70.3.0 (PyPI) | 84.1.0 | setuptools: Windows path escape via namespace\_packages.txt during legacy wheel installation Description | | [GHSA-xmj3-9gf7-h52w](https://osv.dev/vulnerability/GHSA-xmj3-9gf7-h52w) | low (1.0) | setuptools 82.0.1 (PyPI) | 84.1.0 | setuptools: Windows path escape via namespace\_packages.txt during legacy wheel installation Description | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/virtualenv@21.15.6 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/virtualenv/21.15.6.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/virtualenv/21.15.6