CVE-2026-3219

EUVD-2026-23866
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
Debian logo
Debian Releases
Debian Product
Codename
python-pip
bookworm
no-dsa
bullseye
postponed
bullseye (security)
vulnerable
forky
26.1.2+dfsg-1
fixed
sid
26.1.2+dfsg-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-pip
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpython2_7-1_0
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
libpython2_7-1_0-32bit
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
libpython3_13-1_0
suse enterprise desktop 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise sap 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise server 15 SP7
3.13.14-150700.4.53.1
fixed
libpython3_4m1_0
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP3
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
libpython3_4m1_0-32bit
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
libpython3_6m1_0
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
libpython3_6m1_0-32bit
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
python
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-32bit
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-base
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-base-32bit
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-curses
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-demo
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-devel
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-doc
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-doc-pdf
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-gdbm
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-idle
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-pip
suse enterprise sap 12 SP5
10.0.1-13.20.1
fixed
suse enterprise server 12 SP5
10.0.1-13.20.1
fixed
python-tk
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-xml
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python3
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP3
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python3-base
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP3
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python3-curses
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP3
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python3-devel
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python3-pip
suse enterprise sap 12 SP5
10.0.1-13.20.1
fixed
suse enterprise server 12 SP5
10.0.1-13.20.1
fixed
python3-tk
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python311-pip
suse enterprise desktop 15 SP7
22.3.1-150400.17.26.1
fixed
suse enterprise sap 15 SP7
22.3.1-150400.17.26.1
fixed
suse enterprise server 15 SP7
22.3.1-150400.17.26.1
fixed
python313
suse enterprise desktop 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise sap 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise server 15 SP7
3.13.14-150700.4.53.1
fixed
python313-base
suse enterprise desktop 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise sap 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise server 15 SP7
3.13.14-150700.4.53.1
fixed
python313-curses
suse enterprise desktop 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise sap 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise server 15 SP7
3.13.14-150700.4.53.1
fixed
python313-dbm
suse enterprise desktop 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise sap 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise server 15 SP7
3.13.14-150700.4.53.1
fixed
python313-devel
suse enterprise desktop 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise sap 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise server 15 SP7
3.13.14-150700.4.53.1
fixed
python313-idle
suse enterprise desktop 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise sap 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise server 15 SP7
3.13.14-150700.4.53.1
fixed
python313-tk
suse enterprise desktop 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise sap 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise server 15 SP7
3.13.14-150700.4.53.1
fixed
python313-tools
suse enterprise desktop 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise sap 15 SP7
3.13.14-150700.4.53.1
fixed
suse enterprise server 15 SP7
3.13.14-150700.4.53.1
fixed
python36
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
python36-base
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
python36-curses
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-dbm
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-devel
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
python36-idle
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-testsuite
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-tk
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-tools
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python3.11-pip
Amazon Linux 2023
0:22.3.1-2.amzn2023.0.12
fixed
python3.11-pip-wheel
Amazon Linux 2023
0:22.3.1-2.amzn2023.0.12
fixed
python3.12-pip
Amazon Linux 2023
0:23.2.1-4.amzn2023.0.9
fixed
python3.12-pip-wheel
Amazon Linux 2023
0:23.2.1-4.amzn2023.0.9
fixed
python3.13-pip
Amazon Linux 2023
0:24.2-259.amzn2023.0.6
fixed
python3.13-pip-wheel
Amazon Linux 2023
0:24.2-259.amzn2023.0.6
fixed
python3.14-pip
Amazon Linux 2023
0:25.1.1-1.amzn2023.0.3
fixed
python3.14-pip-wheel
Amazon Linux 2023
0:25.1.1-1.amzn2023.0.3
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
python-pip
Azure Linux 3.0
0:24.2-8.azl3
fixed
python-virtualenv
Azure Linux 3.0
0:20.36.1-4.azl3
fixed
Common Weakness Enumeration
References
https://github.com/pypa/pip/pull/13870
https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ/
http://www.openwall.com/lists/oss-security/2026/04/20/8