CVE-2026-3219
MediumAdvisory
Published 20 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 4.6
- base score, highest
- EPSS
- 0.001
- 4th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,265
- of 17,781 indexed, latest versions
- Container images
- 1,215
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
Carried by container images the latest versions of 1,265 of 17,781 indexed charts deploy, on 1,215 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| pippypi | 1.5.4, 8.1.1, 8.1.2, 9.0.0+65 more | 26.1 | 1,207 |
| python-pipdeb | 1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+24 more | no fix listed | 140 |
| py3-pipapk | 25.0.1-r0, 25.2-r0, 25.3-r2, 25.3-r3+2 more | 26.1.1-r0 | 9 |
- OSV records
- CGA-33rw-387h-r2wcCGA-7cc7-f2g6-2gq5CGA-hjw3-7v3m-86rwDEBIAN-CVE-2026-3219GHSA-58qw-9mgm-455vUBUNTU-CVE-2026-3219
- Also known as
- CGA-4gf9-hhmr-5wj7, CGA-7j43-qmq2-2j84, CGA-cp2g-x5m2-rpp9, CGA-fm73-hhr9-j3j7, CGA-jx64-c9rw-9jqr, CGA-m77r-p4v4-p976, CGA-p26j-w2gh-vcv5, CGA-pj9j-7m5w-p5w7, CGA-vpj3-hmwp-h3qf, PYSEC-2026-2875
Charts affected
1,265 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| finops-stackcert-managerVerified publisher | 0.0.5 | 1 of 12See more | 12,562 |
| squestchristianhuthVerified publisher | 6.6.7 | 1 of 4See more | 9,971 |
| syncstorage-rschristianhuthVerified publisher | 6.1.1 | 1 of 2See more | 693 |
| cloudflared-ingress-operatorcloudflared-ingress-operatorVerified publisher | 0.3.2 | 1 of 1See more | 1,724 |
| tensorflow-notebookcloudnativeapp | 0.1.2 | 1 of 1See more | 36,094 |
| cnpg-sandboxcloudnative-pgVerified publisher | 0.6.1 | 1 of 6See more | 7,583 |
| pgbenchcloudnative-pgVerified publisher | 0.1.0 | 1 of 1See more | 2,713 |
| cosmotech-copilot-apicosmotech-apiVerified publisher | 0.1.1 | 1 of 1See more | 11,205 |
| paperless-ngxcrystalnetVerified publisher | 0.2.22 | 1 of 3See more | 13,761 |
| rommcrystalnetVerified publisher | 0.2.20 | 1 of 3See more | 1,944 |
| cubefscubefs | 3.2.0 | 2 of 10See more | 15,891 |
| dagster-cloud-agentdagster-cloudVerified publisher | 1.13.22 | 1 of 1See more | 1,082 |
| aibrixdanchevVerified publisher | 0.7.0 | 1 of 5See more | 5,274 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 1 of 12See more | 38,346 |
| datadogdatadog-test | 2.4.23 | 1 of 2See more | 4,568 |
| mealiedeimosfr-charts | 1.0.15 | 1 of 1See more | 4,028 |
| weblatedeliveryheroVerified publisher | 0.3.2 | 1 of 3See more | 7,984 |
| frontenddemo-application | 0.1.0 | 1 of 1See more | 3,558 |
| kubedashdevopstalesOfficialVerified publisher | 4.0.0 | 1 of 8See more | 9,205 |
| trivy-operatordevopstalesVerified publisher | 2.5.0 | 1 of 1See more | 5,598 |
| dominodominoVerified publisher | 0.1.11 | 1 of 3See more | 8,823 |
| archerydoubanVerified publisher | 0.4.3 | 1 of 6See more | 5,853 |
| seafiledr300481Verified publisher | 0.12.1 | 1 of 1See more | 10,858 |
| craftycontrollerdrewburr-labs-helm-chartsVerified publisher | 0.3.0 | 1 of 1See more | 3,671 |
| dyff-orchestratordyff-orchestratorVerified publisher | 0.22.19 | 1 of 1See more | 1,354 |
| jenkinsedu | 2.7.1 | 1 of 2See more | 4,423 |
| enbuildenbuildVerified publisher | 0.0.50 | 1 of 6See more | 31,510 |
| genesis-generatorethereum-helm-chartsVerified publisher | 0.2.3 | 1 of 2See more | 3,135 |
| fastapi-microservice-appfast-api-microservice-app | 1.3.0 | 3 of 4See more | 9,562 |
| taigafermosit | 0.0.11 | 2 of 7See more | 8,496 |
| pgadmin4folio-org | 1.2.30 | 1 of 1See more | 2,034 |
| home-assistantgabe565Verified publisher | 0.17.0 | 1 of 1See more | 2,133 |
| appdaemongeek-cookbookVerified publisher | 8.4.2 | 1 of 1See more | 3,461 |
| deepstackgeek-cookbookVerified publisher | 1.5.2 | 1 of 2See more | 5,305 |
| healthchecksgeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 1,667 |
| homebridgegeek-cookbookVerified publisher | 5.3.2 | 1 of 1See more | 15,653 |
| kube-ops-viewgeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 1,848 |
| lazylibrariangeek-cookbookVerified publisher | 7.4.2 | 1 of 1See more | 11,662 |
| octoprintgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 3,153 |
| paperlessgeek-cookbookVerified publisher | 9.2.0 | 1 of 1See more | 3,924 |
| recipesgeek-cookbookVerified publisher | 6.6.2 | 1 of 2See more | 7,801 |
| uptime-kumageek-cookbookVerified publisher | 1.4.2 | 1 of 1See more | 5,079 |
| uptimerobot-prometheusgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 2,265 |
| gentrace-self-hostedgentrace-self-hostedVerified publisher | 0.1.3 | 1 of 9See more | 15,562 |
| temporalglasskubeVerified publisher | 0.45.2-gk.1 | 1 of 14See more | 16,346 |
| greenkubegreenkubeVerified publisher | 0.3.0 | 1 of 3See more | 1,809 |
| IMgrycapOfficialVerified publisher | 1.8.0 | 1 of 3See more | 4,132 |
| octoprinthalkeye | 0.1.1 | 1 of 1See more | 3,608 |
| powerdnsadminhalkeye | 0.3.1 | 1 of 1See more | 3,345 |
| haproxy-redis-sentinelhaproxy-redis-sentinelVerified publisher | 0.1.3 | 1 of 2See more | 4,277 |
Container images carrying it
1,215 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| dpage/ | a5a656e1d5fd | pip | 26.1 | 1 |
| dpage/ | b1f00b8163cf | pip | 26.1 | 1 |
| drgrove/ | 361721759a2b | pip | 26.1 | 1 |
| drumsergio/ | ca3476077215 | pip | 26.1 | 1 |
| dserio83/ | 6b3d9115fee2 | pip python-pip | 26.1 no fix listed | 1 |
| dserio83/ | d5deae589229 | pip | 26.1 | 1 |
| dysnix/ | 19951e3e7a32 | pip | 26.1 | 1 |
| eclipseaerios/ | d4ed3d8e5db4 | pip | 26.1 | 1 |
| eclipseaerios/ | 3cc1d94cfe96 | pip | 26.1 | 1 |
| eclipseaerios/ | b433c2b9f5dc | pip | 26.1 | 1 |
| eclipseaerios/ | d582d39208c7 | pip | 26.1 | 1 |
| eclipseaerios/ | 8ed2df4ca692 | pip | 26.1 | 1 |
| eclipseaerios/ | e7f5ba0bc64d | pip | 26.1 | 1 |
| eclipseaerios/ | 34b72f45b46a | pip | 26.1 | 1 |
| eclipseaerios/ | c8af377c709f | pip | 26.1 | 1 |
| eclipseaerios/ | f55442e2c0ed | pip | 26.1 | 1 |
| elastichq/ | bb3bd22c2b87 | pip | 26.1 | 1 |
| elautoestopista/ | 125ba620d528 | pip | 26.1 | 1 |
| elautoestopista/ | b6f74db9fc81 | pip | 26.1 | 1 |
| elyra/ | c922f1f1646a | pip | 26.1 | 1 |
| erenozcan17/ | c9b6f0dfbffc | pip | 26.1 | 1 |
| errbotio/ | 00ee4e0953ab | pip | 26.1 | 1 |
| esailors/ | 5608ae045fa7 | pip | 26.1 | 1 |
| esphome/ | 3f51ec10e823 | pip | 26.1 | 1 |
| esphome/ | 9ab8cc88b28c | pip python-pip | 26.1 no fix listed | 1 |
| esphome/ | b2c6322700ac | pip python-pip | 26.1 no fix listed | 1 |
| esphome/ | def8b6e4f517 | pip python-pip | 26.1 no fix listed | 1 |
| evgkrsk/ | 37f0e1f435c3 | pip | 26.1 | 1 |
| evk02/ | ef6ff257ef35 | pip | 26.1 | 1 |
| factly/ | ca5bc71d1d5c | pip | 26.1 | 1 |
| felipecs8/ | 29e06c9c6385 | pip python-pip | 26.1 no fix listed | 1 |
| fiware/ | 3e3ec88d59ed | pip | 26.1 | 1 |
| fiware/ | 29456835bb2c | pip python-pip | 26.1 no fix listed | 1 |
| fiware/ | c3c1c8ccfb45 | pip | 26.1 | 1 |
| flag5/ | 4ad5748bfcc6 | pip | 26.1 | 1 |
| flagsmith/ | fd58556339a4 | pip | 26.1 | 1 |
| flanksource/ | 689687a7cf95 | pip | 26.1 | 1 |
| flashcatcloud/ | 421acb36181b | pip | 26.1 | 1 |
| flyway/ | 45b5d7cdc75a | pip python-pip | 26.1 no fix listed | 1 |
| flyway/ | 80f12c80502b | pip | 26.1 | 1 |
| forchaladtest/ | 5909cf64ef53 | pip | 26.1 | 1 |
| fossology/ | 8bd1f22ba7bb | pip | 26.1 | 1 |
| foundationdb/ | 07e0ae17a7ca | pip | 26.1 | 1 |
| foundationdb/ | 9ceb2f948c9f | pip | 26.1 | 1 |
| foundationdb/ | da1ee2731024 | pip | 26.1 | 1 |
| frankescobar/ | 8a4d7e9308de | pip python-pip | 26.1 no fix listed | 1 |
| frankescobar/ | cafa03b94dac | pip python-pip | 26.1 no fix listed | 1 |
| freedom98/ | d7ce1533f297 | pip | 26.1 | 1 |
| galaxy/ | e5c265fe9fcd | pip python-pip | 26.1 no fix listed | 1 |
| galaxy/ | 0267bad550e6 | pip python-pip | 26.1 no fix listed | 1 |