CVE-2026-3219: pip doesn't reject concatenated ZIP and tar archives

Overview

Severity

N/A

Exploit Status

Not Exploited

Patch Tuesday

2026-Apr

Released

2026-04-23

EPSS Score

0.01% (percentile: 2.2%)

Affected Products (6)

Other

• 20965-17084
• 21144-17084
• 21139-17086

Open Source Software

• azl3 python3 3.12.9-10 on Azure Linux 3.0
• azl3 tensorflow 2.16.1-11 on Azure Linux 3.0
• cbl2 python3 3.9.19-19 on CBL Mariner 2.0

Revision History

• 2026-04-23: Information published.