CVE-2014-8991: pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation)...

Security readout for executives and security teams

CVE-2014-8991 is a local denial-of-service issue in old pip releases. A user with local access could create predictable /tmp files that prevent another user from installing Python packages. This affects availability of package installation, not confidentiality or remote compromise based on the supplied sources. Exposure is most relevant on legacy systems running pip 1.3 through 1.5.6 with multiple local users sharing /tmp. Modern systems are unlikely to be affected unless they retain old pip packages in base images, appliances, or long-lived build hosts. Handle during legacy dependency cleanup unless affected pip exists on shared infrastructure. Escalate only if package installation reliability is business-critical on multi-user systems. Mitigation focus: Inventory systems and images for pip 1.3 through 1.5.6.; Follow PyPA or distribution guidance to move off affected pip versions.; Prioritize shared hosts, CI workers, and legacy build environments..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.