CVE-2026-3219 is a vulnerability in pip where concatenated tar and ZIP files are improperly processed as ZIP files, regardless of their true format. This leads to incorrect file installation behavior, which may allow an attacker to influence the installation process by supplying a specially crafted archive. The issue affects Red Hat Hardened Images RPMs, specifically python-pip packages. Red Hat has published an advisory (RHSA-2026:20074) describing the issue but has not yet provided a patch or fix. The vulnerability is associated with CWE-1287 (Improper Validation of Specified Type of Input) and CWE-22. Red Hat rates the impact as high due to the potential for integrity impact, though confidentiality and availability are not affected. No known exploits in the wild have been reported.

The vulnerability can cause pip to install unintended or incorrect files due to improper archive handling, potentially allowing an attacker to influence the installation process. This impacts the integrity of the installed software. There is no impact on confidentiality or availability. No active exploitation has been reported. The issue affects Red Hat Hardened Images RPMs that include python-pip packages.

Red Hat has issued a security advisory but has not yet released a fix for this vulnerability. Patch status is not yet confirmed — check the Red Hat advisory (https://access.redhat.com/errata/RHSA-2026:20074) for current remediation guidance. Users should monitor Red Hat communications for updates and apply any future patches promptly. No vendor-provided mitigations or workarounds are currently documented.