Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-07-08T16:02:07
setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)
6.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CWE-1025
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.
A flaw was found in setuptools, a Python package management tool. The FileList component, responsible for handling file exclusions, did not properly normalize Unicode file names when applying exclusion rules. This oversight could allow a specially crafted file name, using a different Unicode normalization form (NFD) on macOS APFS or HFS+ file systems, to bypass an intended exclusion rule (NFC). As a result, sensitive files that should have been excluded could be inadvertently included in a source distribution, leading to information disclosure.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat Hardened Images
2026-07-10T00:00:00Z
RHSA-2026:37530
python-setuptools-main-83.0.0-4.hum1
Exploit Intelligence
Not affected
exploit-intelligence-tech-preview/vulnerability-analysis-rhel9
Lightspeed Core
Not affected
lightspeed-core/lightspeed-stack-rhel9
Lightspeed Core
Not affected
lightspeed-core/rag-tool-cpu-rhel9
Lightspeed Core
Not affected
lightspeed-core/rag-tool-cuda-12.9-rhel9
Migration Toolkit for Applications 8
Not affected
mta/mta-rhel9-operator
Migration Toolkit for Applications 8
Not affected
mta/mta-solution-server-rhel9
Migration Toolkit for Virtualization
Not affected
migration-toolkit-virtualization/mtv-deep-inspection-rhel10
Migration Toolkit for Virtualization
Not affected
migration-toolkit-virtualization/mtv-deep-inspection-rhel9
Migration Toolkit for Virtualization
Not affected
migration-toolkit-virtualization/mtv-rhel9-operator
Migration Toolkit for Virtualization
Not affected
migration-toolkit-virtualization/mtv-rhv-populator-rhel8
Migration Toolkit for Virtualization
Not affected
mtv-candidate/mtv-rhel9-operator
Network Observability Operator
Not affected
network-observability/network-observability-operator-bundle
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-ocp-rag-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-service-api-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat AI Inference Server
Not affected
rhaii/model-opt-cuda-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/model-opt-cuda-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/vllm-cpu-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/vllm-neuron-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/vllm-rocm-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/vllm-spyre-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/vllm-tpu-rhel9
Red Hat AI Inference Server
Not affected
rhaii/vllm-cpu-rhel9
Red Hat AI Inference Server
Not affected
rhaii/vllm-cuda-rhel9
Red Hat AI Inference Server
Not affected
rhaii/vllm-gaudi-rhel9
Red Hat AI Inference Server
Not affected
rhaii/vllm-neuron-rhel9
Red Hat AI Inference Server
Not affected
rhaii/vllm-rocm-rhel9
Red Hat AI Inference Server
Not affected
rhaii/vllm-spyre-rhel9
Red Hat AI Inference Server
Not affected
rhaii/vllm-tpu-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-24/de-supported-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-24/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-25/de-minimal-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-25/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-25/ee-supported-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-25/lightspeed-chatbot-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/ansible-builder-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/controller-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/controller-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/eda-controller-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/eda-controller-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/ee-minimal-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/ee-supported-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/gateway-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/hub-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/hub-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/lightspeed-chatbot-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/lightspeed-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/mcp-tools-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/platform-resource-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/platform-resource-runner-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/aap-cloud-billing-operator-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/aap-cloud-billing-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/ansible-builder-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/controller-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/controller-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/eda-controller-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/eda-controller-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/ee-supported-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/gateway-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/hub-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/hub-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/lightspeed-chatbot-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/lightspeed-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/mcp-tools-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/metrics-service-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/metrics-service-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/platform-resource-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/platform-resource-runner-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform/automation-dashboard-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-tech-preview/ansible-devspaces-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-tech-preview/metrics-service-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-tech-preview/metrics-service-rhel9-operator
Red Hat Ansible Automation Platform 2
Not affected
automation-controller
Red Hat build of Quarkus Native builder
Not affected
setuptools
Red Hat Ceph Storage 7
Not affected
rhceph/rhceph-7-rhel9
Red Hat Ceph Storage 9
Not affected
rhceph/rhceph-9-rhel9
Red Hat Developer Hub
Not affected
rhdh/rhdh-hub-rhel9
Red Hat Enterprise Linux 10
Not affected
python3.14-pip
Red Hat Enterprise Linux 10
Not affected
python-pip
Red Hat Enterprise Linux 10
Not affected
rhel10-eus/rhel-10.0-bootc
Red Hat Enterprise Linux 10
Not affected
rhel10-eus/rhel-10.2-bootc
Red Hat Enterprise Linux 10
Not affected
rhel10/rhel-bootc
Red Hat Enterprise Linux 10
Not affected
rhel10/rteval
Red Hat Enterprise Linux 10
Not affected
rhel10/support-tools
Red Hat Enterprise Linux 7
Not affected
python-pip
Red Hat Enterprise Linux 8
Not affected
fence-agents
Red Hat Enterprise Linux 8
Not affected
python3.12-pip
Red Hat Enterprise Linux 8
Not affected
python-pip
Red Hat Enterprise Linux 8
Not affected
rhel8-4-els/rhel
Red Hat Enterprise Linux 8
Not affected
ubi8/python-311
Red Hat Enterprise Linux 8
Not affected
ubi8/python-312
Red Hat Enterprise Linux 8
Not affected
ubi8/python-36
Red Hat Enterprise Linux 8
Not affected
ubi8/python-39
Red Hat Enterprise Linux 8
Not affected
ubi8/toolbox
Red Hat Enterprise Linux 9
Not affected
python3.12-pip
Red Hat Enterprise Linux 9
Not affected
python3.14-pip
Red Hat Enterprise Linux 9
Not affected
python-pip
Red Hat Enterprise Linux 9
Not affected
rhel9-2-els/rhel
Red Hat Enterprise Linux 9
Not affected
rhel9-8-els/rhel
Red Hat Enterprise Linux 9
Not affected
rhel9-eus/rhel-9.6-bootc
Red Hat Enterprise Linux 9
Not affected
rhel9-eus/rhel-9.8-bootc
Red Hat Enterprise Linux 9
Not affected
rhel9/keylime-registrar
Red Hat Enterprise Linux 9
Not affected
rhel9/keylime-verifier
Red Hat Enterprise Linux 9
Not affected
rhel9/python-311
Red Hat Enterprise Linux 9
Not affected
rhel9/python-39
Red Hat Enterprise Linux 9
Not affected
rhel9/rhel-bootc
Red Hat Enterprise Linux 9
Not affected
ubi9/python-311
Red Hat Enterprise Linux 9
Not affected
ubi9/python-312
Red Hat Enterprise Linux 9
Not affected
ubi9/python-39
Red Hat Enterprise Linux 9
Not affected
ubi9/toolbox
Red Hat Enterprise Linux 9
Not affected
ubi9/ubi9
Red Hat Enterprise Linux 9
Not affected
ubi9/ubi-stig
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-aws-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-azure-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-azure-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-gcp-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-rocm-rhel9
Red Hat Hardened Images
Not affected
harfbuzz
Red Hat Hardened Images
Not affected
python3-mypy
Red Hat Hardened Images
Not affected
python-cryptography
Red Hat Hardened Images
Not affected
python-sentry-sdk
Red Hat Hardened Images
Not affected
qt6-qtbase
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-caikit-nlp-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-caikit-tgis-serving-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-feature-server-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-guardrails-detector-huggingface-runtime-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-agent-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-autogluon-server-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-controller-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-router-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-storage-initializer-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-llama-stack-core-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-llm-d-kv-cache-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-ml-pipelines-runtime-generic-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlserver-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-modelmesh-runtime-adapter-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-model-registry-job-async-upload-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipelines-components-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-ta-lmes-job-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-training-cuda121-torch24-py311-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-training-cuda124-torch25-py311-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-training-cuda128-torch28-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-training-cuda128-torch29-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-training-rocm62-torch24-py311-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-training-rocm62-torch25-py311-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-training-rocm64-torch28-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-training-rocm64-torch29-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-trustyai-nemo-guardrails-server-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/dpdk-base-rhel8
Red Hat OpenShift Dev Spaces
Not affected
devspaces/devspaces-operator-bundle
Red Hat OpenShift Dev Spaces
Not affected
devspaces/udi-base-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/udi-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/ocp-virt-validation-checkup-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/virt-launcher-rhel9
Red Hat Quay 3
Not affected
quay/quay-rhel8
Red Hat Quay 3
Not affected
quay/quay-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-advisor-backend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-advisor-engine-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-host-inventory-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-insights-engine-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-puptoo-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-vmaas-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-vulnerability-engine-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-yuptoo-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/segment-reporting-rhel9
Self-service automation portal 2
Not affected
ansible-automation-platform/bootc-automation-portal-rhel9
Service Telemetry Framework 1.5
Not affected
stf/prometheus-webhook-snmp-rhel9
Service Telemetry Framework 1.5
Not affected
stf/service-telemetry-rhel9-operator
Service Telemetry Framework 1.5
Not affected
stf/smart-gateway-rhel9-operator
https://www.cve.org/CVERecord?id=CVE-2026-59890
https://nvd.nist.gov/vuln/detail/CVE-2026-59890
https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f
https://github.com/pypa/setuptools/releases/tag/v83.0.0
https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c