CVE-2026-3219

EUVD-2026-23866
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
Debian logo
Debian Releases
Debian Product
Codename
python-pip
bookworm
no-dsa
bullseye
postponed
bullseye (security)
vulnerable
forky
26.1.2+dfsg-1
fixed
sid
26.1.2+dfsg-1
fixed
trixie
no-dsa
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpython2_7-1_0
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
libpython2_7-1_0-32bit
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-32bit
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-base
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-base-32bit
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-curses
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-demo
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-devel
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-doc
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-doc-pdf
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-gdbm
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-idle
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-tk
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
python-xml
suse enterprise server 12 SP3
2.7.18-28.157.1
fixed
suse enterprise server 12 SP5
2.7.18-33.79.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python3.11-pip
Amazon Linux 2023
0:22.3.1-2.amzn2023.0.12
fixed
python3.11-pip-wheel
Amazon Linux 2023
0:22.3.1-2.amzn2023.0.12
fixed
python3.12-pip
Amazon Linux 2023
0:23.2.1-4.amzn2023.0.9
fixed
python3.12-pip-wheel
Amazon Linux 2023
0:23.2.1-4.amzn2023.0.9
fixed
python3.13-pip
Amazon Linux 2023
0:24.2-259.amzn2023.0.6
fixed
python3.13-pip-wheel
Amazon Linux 2023
0:24.2-259.amzn2023.0.6
fixed
python3.14-pip
Amazon Linux 2023
0:25.1.1-1.amzn2023.0.3
fixed
python3.14-pip-wheel
Amazon Linux 2023
0:25.1.1-1.amzn2023.0.3
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
python-pip
Azure Linux 3.0
0:24.2-8.azl3
fixed
python-virtualenv
Azure Linux 3.0
0:20.36.1-4.azl3
fixed
Common Weakness Enumeration
References
https://github.com/pypa/pip/pull/13870
https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ/
http://www.openwall.com/lists/oss-security/2026/04/20/8