Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-2219

It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compress

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
debian

Description

It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Debian dpkg

Default version status: affected

  • 1.21.18 to < 1.23.6affected

References