CVE-2026-2219
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does...
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
CVE-2026-2219- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
EUVDEUVD-2026-10138
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
EUVD-2026-10138- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x8w5-j8fh-hpvp
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does...
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
GHSA-x8w5-j8fh-hpvp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
NVD
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
CVE-2026-2219- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-2219
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
ALPINE-CVE-2026-2219- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
CVE-2026-2219- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2026-2219
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
DEBIAN-CVE-2026-2219- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-2219
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
UBUNTU-CVE-2026-2219- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-79509 No score
CVE-2026-2219 affecting package dpkg 1.20.10-1
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
AZL-79509- Updated
- 2026-11-02
OSVMGASA-2026-0144 No score
Updated dpkg packages fix security vulnerabilities
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
- Record
MGASA-2026-0144- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10675-1 No score
dpkg-1.22.22-1.1 on GA media
These are all security issues fixed in the dpkg-1.22.22-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10675-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20909-1 No score
Security update for dpkg
This update for dpkg fixes the following issue:
- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).
- Record
openSUSE-SU-2026:20909-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-2219 No score
CVE-2026-2219 in rootio-dpkg - Patched by Root
Root has patched CVE-2026-2219 in the rootio-dpkg package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-2219- Updated
- 2026-11-02
OSVSUSE-SU-2026:20766-1 No score
Security update for dpkg
This update for dpkg fixes the following issue:
- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).
- Record
SUSE-SU-2026:20766-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20795-1 No score
Security update for dpkg
This update for dpkg fixes the following issue:
- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).
- Record
SUSE-SU-2026:20795-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22046-1 No score
Security update for dpkg
This update for dpkg fixes the following issue:
- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).
- Record
SUSE-SU-2026:22046-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22085-1 No score
Security update for dpkg
This update for dpkg fixes the following issue:
- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).
- Record
SUSE-SU-2026:22085-1- Updated
- 2026-11-02
OSVUSN-8249-1 No score
dpkg vulnerability
Yashashree Gund discovered that the dpkg dpkg-deb tool incorrectly handled certain zstd-compressed .deb archives. If a user or automated system were tricked into manipulating a specially crafted .deb archive, a remote attacker could possibly use this issue to cause dpkg-deb to stop responding, resulting in a denial of service.
- Record
USN-8249-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dpkgAzure Linux:2 |
through 1.20.10-1 | None known |
dpkgDebian:12 |
before 1.21.23, plus listed versions 1.21.22 |
1.21.23 |
dpkgDebian:13 |
before 1.22.22, plus listed versions 1.22.21 |
1.22.22 |
dpkgDebian:14 |
before 1.23.6, plus listed versions 1.22.211.22.221.23.01.23.11.23.21.23.31.23.41.23.5 |
1.23.6 |
dpkgMageia:9 |
before 1.22.22-1.mga9 | 1.22.22-1.mga9 |
update-alternativesSUSE:Linux Micro 6.1 |
before 1.22.0-slfo.1.1_3.1 | 1.22.0-slfo.1.1_3.1 |
update-alternativesSUSE:Linux Micro 6.0 |
before 1.22.0-3.1 | 1.22.0-3.1 |
update-alternativesSUSE:Linux Micro 6.2 |
before 1.22.21-160000.3.1 | 1.22.21-160000.3.1 |
dpkgSUSE:Linux Enterprise Server 16.0 |
before 1.22.21-160000.3.1 | 1.22.21-160000.3.1 |
update-alternativesSUSE:Linux Enterprise Server 16.0 |
before 1.22.21-160000.3.1 | 1.22.21-160000.3.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dpkgSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 1.22.21-160000.3.1 | 1.22.21-160000.3.1 |
update-alternativesSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 1.22.21-160000.3.1 | 1.22.21-160000.3.1 |
dpkgUbuntu:24.04:LTS |
before 1.22.6ubuntu6.6, plus listed versions 1.22.0ubuntu11.22.1ubuntu21.22.1ubuntu31.22.1ubuntu51.22.2ubuntu2 Show 7 moreShow less1.22.4ubuntu31.22.4ubuntu51.22.6ubuntu51.22.6ubuntu61.22.6ubuntu6.11.22.6ubuntu6.21.22.6ubuntu6.5 |
1.22.6ubuntu6.6 |
dpkgUbuntu:25.10 |
before 1.22.21ubuntu3.2, plus listed versions 1.22.18ubuntu21.22.18ubuntu31.22.21ubuntu11.22.21ubuntu31.22.21ubuntu3.1 |
1.22.21ubuntu3.2 |
dpkgopenSUSE:Tumbleweed |
before 1.22.22-1.1 | 1.22.22-1.1 |
dpkgopenSUSE:Leap 16.0 |
before 1.22.21-160000.3.1 | 1.22.21-160000.3.1 |
update-alternativesopenSUSE:Leap 16.0 |
before 1.22.21-160000.3.1 | 1.22.21-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-2219 is a high vulnerability (CVSS 7.5) in Debian Dpkg, published March 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in dpkg 1.21.23.
References
git.dpkg.org/cgit/dpkg/dpkg.git/commit?id=6610297a62c0780dd0e80b0e302ef64fdcc9d313
bugs.debian.org/1129722
nvd.nist.gov/vuln/detail/CVE-2026-2219
github.com/advisories/GHSA-x8w5-j8fh-hpvp
security.alpinelinux.org/vuln/CVE-2026-2219
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2026-2219
advisories.mageia.org/MGASA-2026-0144.html
bugs.mageia.org/show_bug.cgi?id=35489
lists.opensuse.org/archives/list/[email protected]/message/3QFBK2ZJ4T5BTAWBSDBQLVRZQKJEAJEX
suse.com/support/update/announcement/2026/suse-su-202620766-1
bugzilla.suse.com/1259385
ubuntu.com/security/CVE-2026-2219
cve.org/CVERecord?id=CVE-2026-2219