CVE-2026-6357 (MEDIUM): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-6357](https://avd.aquasec.com/nvd/cve-2026-6357) | `MEDIUM` | `pip` | `25.3` | `26.1` | `2026-04-27T15:16:20.857Z` | `2026-05-07T10:18:45.188533044Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/python:latest` | `public.ecr.aws/lambda/python@sha256:67b32eb858d2124326e3887fa825a0db934cbbd22f2b0ce489ee1def49020cfe` |
| `public.ecr.aws/lambda/python:3.14` | `public.ecr.aws/lambda/python@sha256:0c835d3c9914f58235f5e06d57518da4e93352be1969f4f2b28718a08b7a2745` |
| `public.ecr.aws/lambda/python:3.13` | `public.ecr.aws/lambda/python@sha256:67b32eb858d2124326e3887fa825a0db934cbbd22f2b0ce489ee1def49020cfe` |
| `public.ecr.aws/lambda/python:3.12` | `public.ecr.aws/lambda/python@sha256:a72dd317346038b51d46d04bca69824936ac417ba7c5331bd0bc544f25ba40a1` |
| `public.ecr.aws/lambda/python:3.11` | `public.ecr.aws/lambda/python@sha256:cd5d6925dac3a578a58ea2af17ecc7c9bece98f1e1d993f5165f69caf7129225` |
| `public.ecr.aws/lambda/python:3.10` | `public.ecr.aws/lambda/python@sha256:9dbd3f8e1e1fbc65eef14ef267be21dde0aef57efb958fa170c77f0f7e71f2a9` |

---

## Description

> pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

---

### Remediation Steps
- Update the affected package `pip` from version `25.3` to `26.1`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.