PyPI/pip CVE-2026-3219: unknown, EPSS 0.14%

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

Action: Upgrade pip to 26.1 or later.

pip install pip==26.1

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2875
• https://nvd.nist.gov/vuln/detail/CVE-2026-3219
• https://github.com/pypa/pip/issues/13867
• https://github.com/pypa/pip/pull/13870
• https://github.com/pypa/pip
• https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ
• http://www.openwall.com/lists/oss-security/2026/04/20/8
• https://pypi.org/project/pip
• https://github.com/advisories/GHSA-58qw-9mgm-455v

CVE-2026-3219 · published 2026-07-13T15:02:52.238290Z · modified 2026-07-13T16:31:33.455648094Z · JSON