pip doesn't reject concatenated ZIP and tar archives
Priority LOW 20CWE-434Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 21 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-434.
Summary
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00144 3rd percentileScored 2026-11-07
Fix Partial pip (Python Packaging Authority): 26.1pip (PyPI): 26.1Red Hat: 5 advisoriesRed Hat: 2 fixed, 21 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Packaging Authority | pip | before 26.1 | 26.1 | Patch available | CNA |
| — | pip (PyPI) | before 26.1 | 26.1 | Patch available | GHSA-58qw-9mgm-455v |
- pip VendorPython Packaging Authority Affected before 26.1 Fixed in 26.1 Patch available CNA
- pip (PyPI) Vendor— Affected before 26.1 Fixed in 26.1 Patch available GHSA-58qw-9mgm-455v
Remediation
- Fix · CNA pip (Python Packaging Authority) Fixed in 26.1
- Fix · GHSA-58qw-9mgm-455v pip (PyPI) Fixed in 26.1 Advisory →
Red Hat 5 advisories
- RHSA-2026:94476 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Base Images 3.0.8 (CUDA)
- Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
- RHSA-2026:91236 Released 2026-10-27 · Red Hat rating CriticalRed Hat AI Base Images 3.0.7 (CUDA)
- Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
- RHSA-2026:91219 Released 2026-10-27 · Red Hat rating CriticalRed Hat AI Base Images 3.0.7 (ROCm)
- Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
Show 2 more Red Hat advisories
- RHSA-2026:36359 Released 2026-07-07 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images python-pip-26.1.2-1.hum1@src, python-pip-wheel-26.1.2-1.hum1@noarch@public-hummingbird-aarch64-rpms, python-pip-wheel-26.1.2-1.hum1@noarch@public-hummingbird-x86_64-rpms +2
- RHSA-2026:20074 Released 2026-05-21 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images python-pip-26.1.1-3.hum1@src, python-pip-wheel-26.1.1-3.hum1@noarch@public-hummingbird-aarch64-rpms, python-pip-wheel-26.1.1-3.hum1@noarch@public-hummingbird-x86_64-rpms +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Service Telemetry Framework 1.5 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:20074, RHSA-2026:36359 |
| Red Hat OpenShift AI 3.0 | Fixed | RHSA-2026:91219, RHSA-2026:91236, RHSA-2026:94476 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3219
- 2026-10-03 Alias added: GHSA-58qw-9mgm-455v
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91219 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91236 · Red Hat
- 2026-10-30 Fix available: Red Hat OpenShift AI 3.0 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94476 · Red Hat
- 2026-11-04 Affected versions changed · Red Hat
References
Advisory 2
More Python Packaging Authority vulnerabilities
- TI-2025-08119 Fallback tar extraction in pip doesn't check symbolic links point to extraction directory CVSS 4.0MEDIUM 5.9
- TI-2026-01386 Limited path traversal when installing wheel archives CVSS 4.0LOW 2.0
Sources
- CVE-2026-3219 · CVE Program
- CVE-2026-3219 · NVD
- FIRST EPSS
- GHSA-58qw-9mgm-455v · GitHub Advisory Database · CC BY 4.0
- CVE-2026-3219 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences