wfuzz: No module named 'pkg_resources' (and pip install fails)

wfuzz 3.1.0 (the latest) cannot be installed with pip 24.1+ because of an invalid pyparsing (>=2.4*) requirement, and once installed it fails with ModuleNotFoundError: No module named 'pkg_resources' on setuptools 82+. Tested fix: pip<24.1 to install, then setuptools<81.

1. First wall: pip refuses to install wfuzz 3.1.0

wfuzz 3.1.0 (2020-11-06) is the latest release on PyPI. Its wheel declares pyparsing (>=2.4*), which is not a valid version specifier. pip 24.1 and newer reject it. With pip 26.2.2 on Python 3.11:

$ pip install wfuzz==3.1.0
WARNING: Ignoring version 3.1.0 of wfuzz since it has invalid metadata:
Requested wfuzz==3.1.0 from https://files.pythonhosted.org/packages/7d/19/551b10d27bdeecd93564034ac1e7b42fbd7a9bea12501723bde5abf7f227/wfuzz-3.1.0-py3-none-any.whl has invalid metadata: Expected matching RIGHT_PARENTHESIS for LEFT_PARENTHESIS, after version specifier
    pyparsing (>=2.4*) ; python_version >= "3.5"
              ~~~~~~^
Please use pip<24.1 if you need to use this version.
ERROR: No matching distribution found for wfuzz==3.1.0

Plain pip install wfuzz is worse: pip 26.2.2 skipped every release from 3.1.0 down to 2.4.6 for the same reason, fell back to an older one that requires pycurl<=7.43.0.3, and failed with ERROR: Failed to build 'pycurl'. Use pip below 24.1 inside a venv just for wfuzz:

$ python -m pip install "pip<24.1"    # gave pip 24.0
$ pip install wfuzz==3.1.0

pip 24.0 installed it with a DEPRECATION notice about the same specifier. uv pip install also rejected the metadata in our test.

2. Second wall: No module named 'pkg_resources'

wfuzz does not depend on setuptools, so it uses whatever the venv has. With setuptools 84.2.1:

$ wfuzz --version
...
  File "wfuzz/facade.py", line 1, in <module>
    from .helpers.file_func import get_home, get_path, get_config_dir
  File "wfuzz/helpers/file_func.py", line 4, in <module>
    import pkg_resources
ModuleNotFoundError: No module named 'pkg_resources'

wfuzz/helpers/file_func.py line 4 is a plain import pkg_resources, and setuptools 82.0.0 removed that module. The GitHub master branch still has the same line (last commit 2026-01-21, no release since 3.1.0).

3. Fix: pin setuptools below 81 (tested)

$ pip install "setuptools<81"    # gave 80.10.2
$ wfuzz --version
 wfuzz/helpers/file_func.py:4: UserWarning:pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
default
default
3.1.0

A real scan worked too. Against a local test server where only /2 exists:

$ PYTHONWARNINGS="ignore:pkg_resources is deprecated as an API" wfuzz -z range,1-3 --hc 404 http://127.0.0.1:8963/FUZZ
default
default
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://127.0.0.1:8963/FUZZ
Total requests: 3

=====================================================================
ID           Response   Lines    Word       Chars       Payload

=====================================================================
000000002:   200        1 L      1 W        3 Ch        "2"
Total time: 0
Processed Requests: 3
Filtered Requests: 2
Requests/sec.: 0

The PYTHONWARNINGS setting hides the harmless pkg_resources is deprecated warning. pycurl 7.48.0 installed from a prebuilt wheel, so no libcurl headers were needed. If you only need wfuzz on Kali or another distro that packages it, the system package avoids both walls (we did not test it).

Related: No module named 'pkg_resources' (general fix) · Open Interpreter (same cause) · scrapyd.

Written with AI assistance. Measured on 2026-10-24 on Linux with wfuzz 3.1.0, pycurl 7.48.0, CPython 3.11.17, pip 24.0 and 26.2.2, setuptools 80.10.2 and 84.2.1. Output pasted unedited except shortened paths, cut tracebacks, removed color codes, and the filtered 404 rows that wfuzz erases on screen removed. PlainTables is our extension; wfuzz is free.