PyPI/pip CVE-2026-3219: medium 4.6, EPSS 0.14%

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

Action: Upgrade pip to 26.1 or later.

pip install pip==26.1

Affected

Fixed versions

Sources

• osv: GHSA-58qw-9mgm-455v
• nvd: CVE-2026-3219
• https://github.com/pypa/pip/issues/13867
• https://github.com/pypa/pip/pull/13870
• https://github.com/pypa/pip
• https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ
• http://www.openwall.com/lists/oss-security/2026/04/20/8

CVE-2026-3219 · published 2026-04-20T18:31:48Z · modified 2026-09-10T03:50:42.838011658Z · JSON