CVE-2026-3219

Medium

Advisory

Published 20 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.6; base score, highest
EPSS: 0.001; 4th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,265; of 17,781 indexed, latest versions
Container images: 1,215; deployed by those charts
Fix available: 2 of 3; affected packages

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

Carried by container images the latest versions of 1,265 of 17,781 indexed charts deploy, on 1,215 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+65 more	26.1	1,207
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+24 more	no fix listed	140
py3-pipapk	25.0.1-r0, 25.2-r0, 25.3-r2, 25.3-r3+2 more	26.1.1-r0	9

OSV records: CGA-33rw-387h-r2wc CGA-7cc7-f2g6-2gq5 CGA-hjw3-7v3m-86rw DEBIAN-CVE-2026-3219 GHSA-58qw-9mgm-455v UBUNTU-CVE-2026-3219
Also known as: CGA-4gf9-hhmr-5wj7, CGA-7j43-qmq2-2j84, CGA-cp2g-x5m2-rpp9, CGA-fm73-hhr9-j3j7, CGA-jx64-c9rw-9jqr, CGA-m77r-p4v4-p976, CGA-p26j-w2gh-vcv5, CGA-pj9j-7m5w-p5w7, CGA-vpj3-hmwp-h3qf, PYSEC-2026-2875

Charts affected

1,265 by stars

Chart

Latest

Affected images

Radar Score

finops-stackcert-manager

0.0.5

1 of 12 See more

finops-stack cert-manager 0.0.5

1 of the 12 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.1

Open the chart page →

12,562

squestchristianhuth

6.6.7

1 of 4 See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
quay.io/hewlettpackardenterprise/squest :2.8.4	65694109877e	pip@25.0.1	26.1

Open the chart page →

9,971

syncstorage-rschristianhuth

6.1.1

1 of 2 See more

syncstorage-rs christianhuth 6.1.1

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/porelli/firefox-sync :syncstorage-rs-mysql-0.18.2	7d244e514216	pip@20.3.4	26.1

Open the chart page →

693

cloudflared-ingress-operatorcloudflared-ingress-operator

0.3.2

1 of 1 See more

cloudflared-ingress-operator cloudflared-ingress-operator 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/livepeer/cloudflared-ingress-operator :latest	c179cdcaa050	pip@25.3	26.1

Open the chart page →

1,724

tensorflow-notebookcloudnativeapp

0.1.2

1 of 1 See more

tensorflow-notebook cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
tensorflow/tensorflow :1.6.0-devel	1e3172090703	pip@9.0.1	26.1

Open the chart page →

36,094

cnpg-sandboxcloudnative-pg

0.6.1

1 of 6 See more

cnpg-sandbox cloudnative-pg 0.6.1

1 of the 6 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.15.1	a25886092fa4	pip@21.2.4	26.1

Open the chart page →

7,583

pgbenchcloudnative-pg

0.1.0

1 of 1 See more

pgbench cloudnative-pg 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/cloudnative-pg/postgresql :14.5	b3b30d04b362	pip@20.3.4	26.1

Open the chart page →

2,713

cosmotech-copilot-apicosmotech-api

0.1.1

1 of 1 See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	pip@23.0.1	26.1

Open the chart page →

11,205

paperless-ngxcrystalnet

0.2.22

1 of 3 See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	pip@24.2	26.1

Open the chart page →

13,761

rommcrystalnet

0.2.20

1 of 3 See more

1,944

cubefscubefs

3.2.0

2 of 10 See more

cubefs cubefs 3.2.0

2 of the 10 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
chubaofs/cfs-client :3.2.0	15ff74209ce7	pip@20.3.4	26.1
chubaofs/cfs-server :3.2.0	205030e045f2	pip@20.3.4	26.1

Open the chart page →

15,891

dagster-cloud-agentdagster-cloud

1.13.22

1 of 1 See more

dagster-cloud-agent dagster-cloud 1.13.22

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
dagster/dagster-cloud-agent :1.13.22	9674f3b94a3b	pip@25.0.1	26.1

Open the chart page →

1,082

aibrixdanchev

0.7.0

1 of 5 See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
aibrix/metadata-service :v0.7.0	63fb81a64377	pip@24.0	26.1

Open the chart page →

5,274

data-fairdata354-helm

1.1.2

1 of 12 See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
apsl/thumbor :6.7.0	51e2de5c2c70	pip@19.3.1	26.1

Open the chart page →

38,346

datadogdatadog-test

2.4.23

1 of 2 See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
datadog/agent :7.22.0	8f20e56b5311	pip@20.1.1	26.1

Open the chart page →

4,568

mealiedeimosfr-charts

1.0.15

1 of 1 See more

mealie deimosfr-charts 1.0.15

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.24.0	0b08ac3a9f0a	pip@26.0.1	26.1

Open the chart page →

4,028

weblatedeliveryhero

0.3.2

1 of 3 See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	pip@20.2.2	26.1

Open the chart page →

7,984

frontenddemo-application

0.1.0

1 of 1 See more

frontend demo-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
azhar008/flaskapplication :latest	a1e827b0adea	pip@21.2.4	26.1

Open the chart page →

3,558

kubedashdevopstales

4.0.0

1 of 8 See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
devopstales/kubedash :3.1.0	8bb837da5aec	pip@24.0	26.1

Open the chart page →

9,205

trivy-operatordevopstales

2.5.0

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	pip@22.0.4	26.1

Open the chart page →

5,598

dominodomino

0.1.11

1 of 3 See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	pip@24.0	26.1

Open the chart page →

8,823

archerydouban

0.4.3

1 of 6 See more

5,853

seafiledr300481

0.12.1

1 of 1 See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	pip@24.2 python-pip@22.0.2+dfsg-1ubuntu0.4	26.1 no fix listed

Open the chart page →

10,858

craftycontrollerdrewburr-labs-helm-charts

0.3.0

1 of 1 See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.1 no fix listed

Open the chart page →

3,671

dyff-orchestratordyff-orchestrator

0.22.19

1 of 1 See more

dyff-orchestrator dyff-orchestrator 0.22.19

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/dyff-orchestrator :0.22.19	9bd5d93aaff7	pip@25.0.1	26.1

Open the chart page →

1,354

jenkinsedu

2.7.1

1 of 2 See more

4,423

enbuildenbuild

0.0.50

1 of 6 See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	pip@9.0.3	26.1

Open the chart page →

31,510

genesis-generatorethereum-helm-charts

0.2.3

1 of 2 See more

genesis-generator ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
skylenet/ethereum-genesis-generator :latest	210353ce7c89	pip@20.3.4	26.1

Open the chart page →

3,135

fastapi-microservice-appfast-api-microservice-app

1.3.0

3 of 4 See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

3 of the 4 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
omkara25/simple-microservice-app-order-service :v2.1	8327546c7aac	pip@23.0.1	26.1
omkara25/simple-microservice-app-payment-service :v2	afff40172b6b	pip@23.0.1	26.1
omkara25/simple-microservice-app-user-service :v2	d62cba548580	pip@23.0.1	26.1

Open the chart page →

9,562

taigafermosit

0.0.11

2 of 7 See more

taiga fermosit 0.0.11

2 of the 7 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
taigaio/taiga-back :latest	4beed8f62c9f	pip@24.0	26.1
taigaio/taiga-protected :latest	fd4568a97a59	pip@24.0	26.1

Open the chart page →

8,496

pgadmin4folio-org

1.2.30

1 of 1 See more

2,034

home-assistantgabe565

0.17.0

1 of 1 See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :latest	612d76760b54	pip@26.0.1	26.1

Open the chart page →

2,133

appdaemongeek-cookbook

8.4.2

1 of 1 See more

appdaemon geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
acockburn/appdaemon :4.0.8	3a93281d7e94	pip@21.0.1	26.1

Open the chart page →

3,461

deepstackgeek-cookbook

1.5.2

1 of 2 See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
robmarkcole/deepstack-ui :latest	410275726459	pip@21.2.4	26.1

Open the chart page →

5,305

healthchecksgeek-cookbook

4.4.2

1 of 1 See more

healthchecks geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
linuxserver/healthchecks :version-v1.20.0	50792a72fc71	pip@21.1.1	26.1

Open the chart page →

1,667

homebridgegeek-cookbook

5.3.2

1 of 1 See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.1 no fix listed

Open the chart page →

15,653

kube-ops-viewgeek-cookbook

1.2.2

1 of 1 See more

kube-ops-view geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
hjacobs/kube-ops-view :20.4.0	58221b57d4d2	pip@20.0.2	26.1

Open the chart page →

1,848

lazylibrariangeek-cookbook

7.4.2

1 of 1 See more

lazylibrarian geek-cookbook 7.4.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	pip@21.1.2	26.1

Open the chart page →

11,662

octoprintgeek-cookbook

6.4.2

1 of 1 See more

octoprint geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
octoprint/octoprint :1.6.1	ea3bffae2470	pip@21.1.2	26.1

Open the chart page →

3,153

paperlessgeek-cookbook

9.2.0

1 of 1 See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :1.8.0	9bbc9a90641e	pip@20.3.4	26.1

Open the chart page →

3,924

recipesgeek-cookbook

6.6.2

1 of 2 See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	pip@21.3.1	26.1

Open the chart page →

7,801

uptime-kumageek-cookbook

1.4.2

1 of 1 See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1.17.1	a4eab252e5a2	pip@18.1	26.1

Open the chart page →

5,079

uptimerobot-prometheusgeek-cookbook

6.4.2

1 of 1 See more

uptimerobot-prometheus geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
billimek/prometheus-uptimerobot-exporter :0.0.1	f14ccd7aad0e	pip@20.1.1	26.1

Open the chart page →

2,265

gentrace-self-hostedgentrace-self-hosted

0.1.3

1 of 9 See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.4.4	c0224a1adf7a	pip@9.0.3	26.1

Open the chart page →

15,562

temporalglasskube

0.45.2-gk.1

1 of 14 See more

temporal glasskube 0.45.2-gk.1

1 of the 14 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.25.0-tctl-1.18.1-cli-1.0.0	cda4901bab53	pip@23.3.1	26.1

Open the chart page →

16,346

greenkubegreenkube

0.3.0

1 of 3 See more

greenkube greenkube 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
greenkube/greenkube :0.3.0	0c01932282a4	pip@25.3	26.1

Open the chart page →

1,809

IMgrycap

1.8.0

1 of 3 See more

4,132

octoprinthalkeye

0.1.1

1 of 1 See more

octoprint halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
octoprint/octoprint :1.4.0	106c26efcd8a	pip@20.3.1	26.1

Open the chart page →

3,608

powerdnsadminhalkeye

0.3.1

1 of 1 See more

powerdnsadmin halkeye 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :0.2.3	099371dd9ba6	pip@20.2.3	26.1

Open the chart page →

3,345

haproxy-redis-sentinelhaproxy-redis-sentinel

0.1.3

1 of 2 See more

haproxy-redis-sentinel haproxy-redis-sentinel 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-3219.

Container image	Digest	Package	Fixed in
ghcr.io/parmincloud/haproxy-redis-sentinel :1.0.0	40a00a6456ae	pip@25.0.1	26.1

Open the chart page →

4,277

Container images carrying it

1,215 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/kiwigrid/k8s-sidecar :1.19.2	6a8671702d6f	pip@22.1.2	26.1	2
quay.io/kiwigrid/k8s-sidecar :2.1.2	716b0b33ff2d	pip@25.3	26.1	2
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.1	2
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.1	2
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.1	2
quay.io/openshift/origin-cli :4.7	464a3af4dfe0	pip@9.0.3	26.1	2
quay.io/openshift/origin-cli :4.8	bb5e052770e5	pip@9.0.3	26.1	2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra :latest	b1198ea741d1	pip@25.3	26.1	2
a10networks/acos-prometheus-exporter :latest	8dc58d434d71	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.1	26.1 no fix listed	1
abdullahkhawer/simple-elasticsearch-cleaner :2.1.0	28a6c3f7e0a9	pip@24.3.1	26.1	1
abhinavsingh/proxy.py :latest	51adc989fd03	pip@24.3.1	26.1	1
acockburn/appdaemon :4.0.8	3a93281d7e94	pip@21.0.1	26.1	1
afrank/mozalert-controller :latest	d463c37b08d7	pip@20.1.1	26.1	1
agentarea/agentarea-api :latest	9e15e16fa758	pip@25.0.1	26.1	1
agentarea/agentarea-mcp-runner :latest	d3c209a5d531	pip@25.0.1	26.1	1
agentarea/agentarea-worker :latest	1e5cb68ee77a	pip@25.0.1	26.1	1
ahmetgrbzz/result_server :1.0	08e10f9c0f53	pip@24.0	26.1	1
ahmetgrbzz/result_server :2.0	35c37ae2bafd	pip@24.0	26.1	1
ahmetgrbzz/web_server :1.0	2e7fef69c29f	pip@24.0	26.1	1
ahmetgrbzz/web_server :2.0	f018bafd2b0c	pip@24.0	26.1	1
aibrix/metadata-service :v0.7.0	63fb81a64377	pip@24.0	26.1	1
airbyte/manifest-server :7.23.7	3b3a670af168	pip@25.2	26.1	1
akeyless/base-rhel :0.0.1	4ba8900a0061	pip@20.2.4	26.1	1
aktosecurity/akto-agent-guard-anonymizer :1.1.4	d4b100cbdc47	pip@25.0.1	26.1	1
aktosecurity/akto-agent-guard-embedder :1.1.6	be8b0e235ac6	pip@26.0.1	26.1	1
aktosecurity/akto-agent-guard-embedder :1.1.4	dbc566b2376c	pip@25.0.1	26.1	1
aktosecurity/akto-agent-guard-worker :1.1.6	17db2702aa8f	pip@26.0.1	26.1	1
aktosecurity/akto-agent-guard-worker :1.1.4	666eaffd5362	pip@25.0.1	26.1	1
alaaamin/reload-count-tornado-py-app :v1.0.1alpine	46da5844794e	pip@22.0.4	26.1	1
alakaganaguathoork/local-business :latest	7eb27b0f4a5a	pip@25.0.1	26.1	1
alerta/alerta-web :8.5.0	4786b9eaa606	pip@20.1.1	26.1	1
alexeyr7/sf-test-app :latest	df0b41fdbd53	pip@22.0.4	26.1	1
alexvm6/generator :latest	fb99ee4f760a	pip@22.3.1	26.1	1
alexvm6/pythonalex :latest	89a05786879c	pip@22.3.1	26.1	1
alfresco/alfresco-activemq :5.18.7-jre17-rockylinux8	5472f88d9b0b	pip@9.0.3	26.1	1
allegroai/clearml :2.0.0-613	713ae38f7daf	pip@24.3.1	26.1	1
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.5	26.1 no fix listed	1
allegroai/clearml-serving-inference :1.3.0	fca885e8cfc6	pip@22.3.1	26.1	1
allegroai/clearml-serving-statistics :1.3.0	c58d9da7bdf8	pip@22.3.1	26.1	1
alpine/k8s :1.22.6	00ac10bcb759	pip@22.0.4	26.1	1
alpine/k8s :1.27.3	21b24e6bf801	pip@23.1.2	26.1	1
alpine/k8s :1.31.10	6dbe6f391eda	pip@25.1.1	26.1	1
alpine/k8s :1.31.13	7a319b15cfc9	pip@25.2	26.1	1
alpine/k8s :1.32.4	7e1e7d5b7a96	pip@25.1	26.1	1
alpine/k8s :1.31.4	9c4976d47656	pip@24.3.1	26.1	1
alpine/k8s :1.18.16	a41efe02a041	pip@21.2.1	26.1	1
alpine/k8s :1.30.0	bd01dae02676	pip@24.0	26.1	1
alpine/k8s :1.30.2	cd560fce90f7	pip@24.1.1	26.1	1
alpine/k8s :1.28.13	e5c0b053fed7	pip@24.2	26.1	1
alpine/k8s :1.32.3	eec354133193	pip@25.0.1	26.1	1