pip: pip: Incorrect file installation due to improper archive handling

🗓️ 07 Jul 2026 20:17:23Reported by RedHatType

A flaw in pip processes concatenated tar and ZIP files as ZIP, causing confusing installs and potential incorrect files on Unix.

Reporter	Title	Published	Views	Family All 92
IBM Security Bulletins	Security Bulletin: Unrestricted upload of file with dangerous type, improper certificate validation, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	24 Jun 202616:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to pip	15 Jul 202606:07	–	ibm
ATTACKERKB	CVE-2026-3219	20 Apr 202614:55	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2026-1665)	20 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-1666)	20 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : python3.14-pip, python3.14-pip-wheel (ALAS2023-2026-1718)	26 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : python3.13-pip, python3.13-pip-wheel (ALAS2023-2026-1719)	27 May 202600:00	–	nessus
Tenable Nessus	Fedora 44 : pypy (2026-130f7539d3)	17 May 202600:00	–	nessus
Tenable Nessus	Fedora 44 : python3.15 (2026-2ee2d7abd5)	25 May 202600:00	–	nessus
Tenable Nessus	Fedora 43 : pypy (2026-3505a95524)	16 May 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	20251124	noarch	python-pip-wheel	26.1.2-1.hum1	python-pip-wheel-26.1.2-1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-3219
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/pypa/pip/pull/13870
mail	www.mail.python.org/archives/list/[email protected]/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-3219
cve	www.cve.org/CVERecord

15 Jul 2026 18:02Current

6.5Medium risk

Vulners AI Score6.5

CVSS 44.6

EPSS0.00144

SSVC