CVE-2026-3219 vulnerabilities

Vulnerabilities for packages: graalvm, nvidia-nsight-compute-13.1, nvidia-nsight-compute-13.3, tensorflow-gpu-jupyter, datadog-agent, datadog-agent-fips, azureml-inference-server-http-fips, azure-functions-host, py3-virtualenv, pypy-3.10, tensorflow-cpu-jupyter, py3.14-virtualenv, request-1276,...

GHSA-58QW-9MGM-455V vulnerabilities

Vulnerabilities for packages: graalvm, nvidia-nsight-compute-13.1, nvidia-nsight-compute-13.3, tensorflow-gpu-jupyter, datadog-agent, datadog-agent-fips, azureml-inference-server-http-fips, azure-functions-host, py3-virtualenv, pypy-3.10, tensorflow-cpu-jupyter, py3.14-virtualenv, request-1276,...

CVE-2026-3219 vulnerabilities

Vulnerabilities for packages: py3-virtualenv, kubeflow-katib, pypy-3.11, datadog-agent, py3-pip, py3-cassandra-medusa, pypy-3.10, py3-pip-wheel-bootstrap, py3.14-virtualenv...

pip 安全漏洞

pip is a Python package installer developed by the Python Packaging Authority. Versions of pip prior to 26.1 contained security vulnerabilities. These vulnerabilities stemmed from the self-update check feature, which ran after the installation of wheel files, potentially leading to the import of...

PT-2026-35435

Name of the Vulnerable Software and Affected Versions pip versions prior to 26.1 Description The self-update check functionality runs after installing wheel files, which requires importing well-known Python module names. These imports were deferred to improve the startup time of the pip CLI. This...

CVE-2026-3219

A flaw was found in pip. This vulnerability occurs because pip incorrectly processes concatenated tar and ZIP files as ZIP files, regardless of their true format. This improper handling can lead to confusing installation behavior, potentially causing the installation of unintended or 'incorrect'...

pip doesn't reject concatenated ZIP and tar archives

...

SUSE CVE-2026-3219

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

aaanalysis (>=0.1.2 <=1.0.2), aadetools (>=0.0.3 <=0.0.5) +582 more potentially affected by CVE-2026-3219 via pip (>=10.0.0b2 <=26.0.1)

pip PYPI version =10.0.0b2, =0.1.2, =0.0.3, =0.5.14, =0.1.1, =2.0.0, =0.2.1, =0.1.2, =0.0.1, =0.1.0, =0.1.10, =0.2.0, =0.68.0, =1.8.15, =1.8.17, =1.8.19 and more Source cves: CVE-2026-3219 Source advisory: OSV:GHSA-58QW-9MGM-455V...

GHSA-58QW-9MGM-455V pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

aaanalysis (>=0.1.2 <=1.0.2), aadetools (>=0.0.3 <=0.0.5) +582 more potentially affected by CVE-2026-3219 via pip (>=10.0.0b2 <=26.0.1)

pip PYPI version =10.0.0b2, =0.1.2, =0.0.3, =0.5.14, =0.1.1, =2.0.0, =0.2.1, =0.1.2, =0.0.1, =0.1.0, =0.1.10, =0.2.0, =0.68.0, =1.8.15, =1.8.17, =1.8.19 and more Source cves: CVE-2026-3219 Source advisory: SNYK:PYTHON-PIP-16115367...

CVE-2026-3219

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

CVE-2026-3219

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

CVE-2026-3219

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

CVE-2026-3219

CVE-2026-3219 : The issue affects the Python package installer, pip, which treats concatenated tar and ZIP archives as ZIP files regardless of the filename or whether a file is both a tar and a ZIP. The root cause is ambiguous archive identification that can lead to confusing installation behavio...

CVE-2026-3219 pip doesn't reject concatenated ZIP and tar archives

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

CVE-2026-3219

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

Linux Distros Unpatched Vulnerability : CVE-2026-3219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in...

pip: pip: Information disclosure via path traversal when installing crafted wheel archives

A flaw was found in pip. A remote attacker could exploit this path traversal vulnerability by tricking a user into installing a maliciously crafted wheel archive. This could lead to files being extracted outside the intended installation directory, potentially disclosing sensitive information...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-pip: python-pip-wheel-26.0.1-2.1.hum1 noarch python3-pip-26.0.1-2.1.hum1 noarch python-pip-26.0.1-2.1.hum1.src src...