CVE-2026-3219

Medium

Advisory

Published 20 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.6; base score, highest
EPSS: 0.001; 4th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,264; of 17,790 indexed, latest versions
Container images: 1,214; deployed by those charts
Fix available: 2 of 3; affected packages

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

Carried by container images the latest versions of 1,264 of 17,790 indexed charts deploy, on 1,214 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+65 more	26.1	1,207
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	139
py3-pipapk	25.0.1-r0, 25.2-r0, 25.3-r2, 25.3-r3+2 more	26.1.1-r0	9

OSV records: CGA-33rw-387h-r2wc CGA-7cc7-f2g6-2gq5 CGA-hjw3-7v3m-86rw DEBIAN-CVE-2026-3219 GHSA-58qw-9mgm-455v UBUNTU-CVE-2026-3219
Also known as: CGA-4gf9-hhmr-5wj7, CGA-7j43-qmq2-2j84, CGA-cp2g-x5m2-rpp9, CGA-fm73-hhr9-j3j7, CGA-jx64-c9rw-9jqr, CGA-m77r-p4v4-p976, CGA-p26j-w2gh-vcv5, CGA-pj9j-7m5w-p5w7, CGA-vpj3-hmwp-h3qf, PYSEC-2026-2875

Charts affected

1,264 by stars

Chart

Latest

Affected images

Radar Score

prometheus-operatorstatcan

0.2.2

1 of 7 See more

prometheus-operator statcan 0.2.2

1 of the 7 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.151	7b98eecdf6d1	pip@20.1	26.1

Open the chart page →

12,237

pagesstephendillondell

1.0.0

1 of 3 See more

20,233

storageclass-routerstorageclass-router

0.4.1

1 of 1 See more

storageclass-router storageclass-router 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
quay.io/maxiv/storageclass-router :0.4.1	60725dab588c	pip@24.0	26.1

Open the chart page →

1,057

sn-platform-slimstreamnative

1.11.44

1 of 6 See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	pip@20.0.2 python-pip@20.0.2-5ubuntu1.10	26.1 no fix listed

Open the chart page →

10,182

studygovernorstudy-governor

0.1.38

1 of 3 See more

studygovernor study-governor 0.1.38

1 of the 3 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	pip@22.0.4	26.1

Open the chart page →

1,447

artifactory-cleanupsubshell

1.0.1

1 of 1 See more

artifactory-cleanup subshell 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
devopshq/artifactory-cleanup :1.0.18	30e093bffa91	pip@23.0.1	26.1

Open the chart page →

2,540

substra-backendsubstra

26.15.3

1 of 7 See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/substra/substra-backend :1.0.1	21967f54ec86	pip@24.0	26.1

Open the chart page →

4,782

verbasubstratus

0.4.0

1 of 1 See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
substratusai/verba :v0.4.0-baseURL2	61695be635eb	pip@23.0.1	26.1

Open the chart page →

12,937

3d-printing-cost-calculatorssudo-kraken-3d-printing-cost-calculators

0.1.4

1 of 1 See more

3d-printing-cost-calculators sudo-kraken-3d-printing-cost-calculators 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/3d-printing-cost-calculators :v1.1.1	220c5e4e1a3d	pip@25.2	26.1

Open the chart page →

2,577

authentik-webfinger-proxysudo-kraken-authentik-webfinger-proxy

0.1.4

1 of 1 See more

authentik-webfinger-proxy sudo-kraken-authentik-webfinger-proxy 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/authentik-webfinger-proxy :v1.1.1	e1351a977607	pip@25.2	26.1

Open the chart page →

2,657

fantasy-dice-chambersudo-kraken-fantasy-dice-chamber

0.1.3

1 of 1 See more

fantasy-dice-chamber sudo-kraken-fantasy-dice-chamber 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/fantasy-dice-chamber :v1.3.2	99fd4cb0f4fe	pip@25.2	26.1

Open the chart page →

2,689

finances-trackersudo-kraken-finances-tracker

0.1.5

1 of 1 See more

finances-tracker sudo-kraken-finances-tracker 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/finances-tracker :v1.1.1	c73527cde81c	pip@25.2	26.1

Open the chart page →

2,657

flaresolverrsudo-kraken-flaresolverr

2.1.4

1 of 1 See more

flaresolverr sudo-kraken-flaresolverr 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/flaresolverr/flaresolverr :v3.4.6	7962759d99d7	pip@25.2	26.1

Open the chart page →

33,591

jf-pushover-webhooksudo-kraken-jf-pushover-webhook

0.1.3

1 of 1 See more

jf-pushover-webhook sudo-kraken-jf-pushover-webhook 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/jf-pushover-webhook :v1.1.0	ee9cf22a39ab	pip@25.2	26.1

Open the chart page →

2,657

qbittorrentsudo-kraken-qbittorrent

5.1.5

1 of 2 See more

qbittorrent sudo-kraken-qbittorrent 5.1.5

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/home-operations/qbittorrent :5.1.4	bb82ad6668f8	pip@25.3	26.1

Open the chart page →

2,130

pagessunilb2590-pages

1.0.0

1 of 3 See more

20,233

netforge-besvtech

0.0.2

1 of 3 See more

4,687

csv-viewsvtech-public-helm-charts

1.0.0

1 of 1 See more

csv-view svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_csv :v1.0.1	b9d7ecf8de24	pip@20.2.2	26.1

Open the chart page →

1,220

freeradiussvtech-public-helm-charts

0.1.5

1 of 4 See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	26.1

Open the chart page →

12,708

icinga2svtech-public-helm-charts

1.0.0

1 of 4 See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_icinga2 :v1.1.6	67be2aba9436	pip@9.0.3	26.1

Open the chart page →

5,101

icinga2-reportsvtech-public-helm-charts

1.0.0

1 of 1 See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
trungkien210493/icinga2-report :v1.7.1	2cc8c3763c4c	pip@20.1.1	26.1

Open the chart page →

1,779

maxscalesvtech-public-helm-charts

1.0.0

1 of 2 See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	26.1

Open the chart page →

5,880

rundecksvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	pip@24.0	26.1

Open the chart page →

18,828

rundeck-option-providersvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck-option-provider svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck_option_provider :v1.1.1	674fad30a51f	pip@20.2.2	26.1

Open the chart page →

1,428

stashswuuper-github

0.1.16

1 of 1 See more

stash swuuper-github 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
stashapp/stash :v0.31.1	df744af5a0c9	pip@25.1.1	26.1

Open the chart page →

2,397

cronjobt3n

0.1.0

1 of 1 See more

10,545

gtmetrix-bqt3n

1.0.0

1 of 1 See more

1,287

take-the-helmtake-the-helm

0.1.0

1 of 1 See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
cadmusthefounder/lnd :take-the-helm-0.1.0	e596c5fbf80f	pip@22.0.4	26.1

Open the chart page →

805

tarkatarka

0.4.1

1 of 4 See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/tarkyaio/tarka :0.4.1	e8d3f1512f06	py3-pip@26.0.1-r2	26.1.1-r0

Open the chart page →

1,556

democharttech-challenge

0.1.0

2 of 4 See more

demochart tech-challenge 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
alexvm6/generator :latest	fb99ee4f760a	pip@22.3.1	26.1
alexvm6/pythonalex :latest	89a05786879c	pip@22.3.1	26.1

Open the chart page →

3,630

rundeck-exportertechpreta

0.1.9

1 of 1 See more

rundeck-exporter techpreta 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
phsmith/rundeck-exporter :2.6.1	0265a7616ae8	pip@22.3.1	26.1

Open the chart page →

1,104

hadoop-deploymenttejaswita-hadoop-helmchart

1.0.0

1 of 1 See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
apache/hadoop :3	af361b20bec0	pip@8.1.2	26.1

Open the chart page →

4,239

temporaltemporal

0.28.9

1 of 13 See more

temporal temporal 0.28.9

1 of the 13 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.22.0	836af062af30	pip@23.1.2	26.1

Open the chart page →

21,004

tensor_apptensor-app

0.2.2

2 of 3 See more

tensor_app tensor-app 0.2.2

2 of the 3 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.1
xeladock/mysql_dns :latest	4baf531453f1	pip@22.0.2 python-pip@22.0.2+dfsg-1	26.1 no fix listed

Open the chart page →

17,561

krokiteochenglim

1.0.1

1 of 5 See more

kroki teochenglim 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
yuzutech/kroki-blockdiag :0.16.0	7c1917c66d96	pip@21.2.4	26.1

Open the chart page →

8,716

pagestest4322

1.0.0

1 of 3 See more

20,233

flask-contactstest-configmap

1.0.1

2 of 3 See more

flask-contacts test-configmap 1.0.1

2 of the 3 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.1
shashkist/flask-contacts-app :latest	581de1fd6084	pip@24.2	26.1

Open the chart page →

5,624

webapp1test-helm-chart-1

0.1.0

1 of 1 See more

webapp1 test-helm-chart-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
devopsjourney1/mywebapp :latest	bd1ec6838570	pip@22.0.4	26.1

Open the chart page →

1,469

asrtest-opea

1.0.0

1 of 1 See more

4,176

chatqnatest-opea

1.0.0

5 of 11 See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
opea/chatqna :1.0	38c51b791efa	pip@24.2	26.1
opea/embedding-tei :1.0	5c9639de61c1	pip@24.0	26.1
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.1
opea/reranking-tei :1.0	e48613afb191	pip@24.2	26.1
opea/retriever-redis :1.0	eb746b263705	pip@24.0	26.1

Open the chart page →

36,661

codegentest-opea

1.0.0

2 of 5 See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
opea/codegen :1.0	58f91683892d	pip@24.2	26.1
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.1

Open the chart page →

26,489

codetranstest-opea

1.0.0

2 of 5 See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
opea/codetrans :1.0	e2436483b73d	pip@24.2	26.1
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.1

Open the chart page →

26,060

docsumtest-opea

1.0.0

2 of 5 See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
opea/docsum :1.0	3eaa91849512	pip@24.2	26.1
opea/llm-docsum-tgi :1.0	02f9e8fa5d71	pip@24.0	26.1

Open the chart page →

26,535

embedding-usvctest-opea

1.0.0

1 of 1 See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
opea/embedding-tei :1.0	5c9639de61c1	pip@24.0	26.1

Open the chart page →

4,829

guardrails-usvctest-opea

1.0.0

1 of 1 See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
opea/guardrails-tgi :1.0	262c6048aab8	pip@24.2	26.1

Open the chart page →

4,865

llm-uservicetest-opea

1.0.0

1 of 1 See more

4,363

reranking-usvctest-opea

1.0.0

1 of 1 See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
opea/reranking-tei :1.0	e48613afb191	pip@24.2	26.1

Open the chart page →

4,629

retriever-usvctest-opea

1.0.0

1 of 1 See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
opea/retriever-redis :1.0	eb746b263705	pip@24.0	26.1

Open the chart page →

4,842

speecht5test-opea

1.0.0

1 of 1 See more

8,877

ttstest-opea

1.0.0

1 of 1 See more

4,160

Container images carrying it

1,214 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
langgenius/dify-sandbox :0.2.15	750e1111426e	pip@26.0.1	26.1	1
lib42/deluge :2	0c4d1d326f95	pip@22.3.1	26.1	1
library/crate :4.7.0	c7984a05e15b	pip@9.0.3	26.1	1
library/mysql :8.4.10	8dbcf531a03a	pip@25.3	26.1	1
library/mysql :8.0.41	bf577825b52a	pip@24.2	26.1	1
library/python :3.8-alpine	3d93b1f77efc	pip@23.0.1	26.1	1
library/python :3.10	70c9cc675605	pip@23.0.1	26.1	1
library/python :3.11-slim	9534e5a8e315	pip@24.0	26.1	1
library/python :3.12-alpine	b64631e04e49	pip@25.0.1	26.1	1
library/python :3.8	d41127070014	pip@23.0.1	26.1	1
library/python :3.9	da5aee29682d	pip@23.0.1	26.1	1
library/python :3.12.9-bullseye	ed4450bab88f	pip@24.3.1	26.1	1
library/python :3.14.3-alpine3.23	faee120f7885	pip@25.3	26.1	1
librenms/librenms :24.11.0	0920bc9117a8	pip@24.3.1	26.1	1
librenms/librenms :22.4.1	4f1f3d667cc7	pip@22.0.4	26.1	1
libretranslate/libretranslate :v1.9.6	1de2d7056bb8	pip@24.0	26.1	1
linuxserver/babybuddy :1.10.2	f7d7c7704249	pip@22.1	26.1	1
linuxserver/beets :1.5.0	e36d16f7341c	pip@21.3.1	26.1	1
linuxserver/calibre-web :0.6.24	241009026e6f	pip@25.2 python-pip@24.0+dfsg-1ubuntu1.2	26.1 no fix listed	1
linuxserver/calibre-web :version-0.6.12	938810eca3d3	pip@21.2.4	26.1	1
linuxserver/couchpotato :75e576ee-ls3	89cd8d5fb1ac	pip@19.0.1	26.1	1
linuxserver/couchpotato :75e576ee-ls32	c4d2766b9eb7	pip@19.3.1	26.1	1
linuxserver/deluge :libtorrentv1-2.2.0-ls40	052eac68ccc0	pip@25.1.1	26.1	1
linuxserver/healthchecks :version-v1.20.0	50792a72fc71	pip@21.1.1	26.1	1
linuxserver/healthchecks :2.7.20230331	94696dab3c50	pip@23.0.1	26.1	1
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	pip@21.1.2	26.1	1
linuxserver/medusa :v0.3.9-ls34	0a5f5114128b	pip@19.2.3	26.1	1
linuxserver/sickchill :v2020.08.07-1-ls40	e48b479c1891	pip@19.3.1	26.1	1
linuxserver/yq :3.2.2	6f5b9586a93e	pip@23.2.1	26.1	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pip@26.0.1 py3-pip@26.0.1-r1	26.1 26.1.1-r0	1
lmacka/snappass :2.1.2	93f5c048b7d4	pip@25.0.1	26.1	1
lnbitsdocker/lnbits-legend :latest	26fae6327477	pip@23.3.1	26.1	1
lnbitsdocker/lnbits-legend :0.10.6	a11aaa6d2b21	pip@23.0.1	26.1	1
lncm/specter-desktop :v0.10.4	bca14d04397d	pip@20.2.3	26.1	1
localstack/localstack :3.1	9d278167f2b7	pip@23.3.2	26.1	1
locustio/locust :2.24.1	51d866285170	pip@24.0	26.1	1
logiqai/toolbox :2.0.1	55a574ec5b64	pip@18.1	26.1	1
louislam/uptime-kuma :1.22.1	0b55bcb83a1c	pip@18.1	26.1	1
louislam/uptime-kuma :1	3d632903e6af	pip@18.1	26.1	1
louislam/uptime-kuma :1.23.13	96510915e6be	pip@18.1	26.1	1
louislam/uptime-kuma :1.17.1	a4eab252e5a2	pip@18.1	26.1	1
louislam/uptime-kuma :1.18.5	a84767d7934f	pip@18.1	26.1	1
louislam/uptime-kuma :1.23.12	bc6f244ecf27	pip@18.1	26.1	1
lsstdm/alert-stream-simulator :v1.2.1	973df082d006	pip@21.2.4	26.1	1
lsstdm/lsst_alert_packet :tickets-DM-32743	74c97a490940	pip@21.2.4	26.1	1
lsstsqre/exposurelog :0.8.0	79b00fb67a65	pip@22.0.3	26.1	1
lsstsqre/kafkaaggregator :master	be1b21060854	pip@21.0.1	26.1	1
lsstsqre/kafkaconnect :0.9.3	4143c7cd705e	pip@21.3.1	26.1	1
lsstsqre/narrativelog :0.1.0	ce01de04ce21	pip@22.0.3	26.1	1
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.1 no fix listed	1