{"id":"CVE-2026-2219","aliases":["ALPINE-CVE-2026-2219","AZL-79509","DEBIAN-CVE-2026-2219","EUVD-2026-10138","GHSA-x8w5-j8fh-hpvp","MGASA-2026-0144","ROOT-OS-DEBIAN-12-CVE-2026-2219","SUSE-SU-2026:20766-1","SUSE-SU-2026:20795-1","SUSE-SU-2026:22046-1","SUSE-SU-2026:22085-1","UBUNTU-CVE-2026-2219","USN-8249-1","openSUSE-SU-2026:10675-1","openSUSE-SU-2026:20909-1"],"status":"published","title":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does...","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00465,"percentile":0.40542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-03-07T08:10:53Z","modified":"2026-10-28T10:51:10Z","fixes":[{"ecosystem":"Debian:12","package":"dpkg","fixed_in":["1.21.23"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dpkg","fixed_in":["1.22.22"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dpkg","fixed_in":["1.23.6"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"dpkg","fixed_in":["1.22.22-1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"update-alternatives","fixed_in":["1.22.0-slfo.1.1_3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"update-alternatives","fixed_in":["1.22.0-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"update-alternatives","fixed_in":["1.22.21-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dpkg","fixed_in":["1.22.21-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"update-alternatives","fixed_in":["1.22.21-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dpkg","fixed_in":["1.22.21-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"update-alternatives","fixed_in":["1.22.21-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"dpkg","fixed_in":["1.22.6ubuntu6.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"dpkg","fixed_in":["1.22.21ubuntu3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"dpkg","fixed_in":["1.22.22-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"dpkg","fixed_in":["1.22.21-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"update-alternatives","fixed_in":["1.22.21-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.10-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.23"}]}],"versions":["1.21.22"]},{"source":"osv","ecosystem":"Debian:13","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22"}]}],"versions":["1.22.21"]},{"source":"osv","ecosystem":"Debian:14","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.6"}]}],"versions":["1.22.21","1.22.22","1.23.0","1.23.1","1.23.2","1.23.3","1.23.4","1.23.5"]},{"source":"osv","ecosystem":"Mageia:9","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"update-alternatives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-slfo.1.1_3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"update-alternatives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"update-alternatives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.21-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.21-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"update-alternatives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.21-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.21-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"update-alternatives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.21-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.6ubuntu6.6"}]}],"versions":["1.22.0ubuntu1","1.22.1ubuntu2","1.22.1ubuntu3","1.22.1ubuntu5","1.22.2ubuntu2","1.22.4ubuntu3","1.22.4ubuntu5","1.22.6ubuntu5","1.22.6ubuntu6","1.22.6ubuntu6.1","1.22.6ubuntu6.2","1.22.6ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.21ubuntu3.2"}]}],"versions":["1.22.18ubuntu2","1.22.18ubuntu3","1.22.21ubuntu1","1.22.21ubuntu3","1.22.21ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.6ubuntu6.6"}]}],"versions":["1.22.0ubuntu1","1.22.1ubuntu2","1.22.1ubuntu3","1.22.1ubuntu5","1.22.2ubuntu2","1.22.4ubuntu3","1.22.4ubuntu5","1.22.6ubuntu5","1.22.6ubuntu6","1.22.6ubuntu6.1","1.22.6ubuntu6.2","1.22.6ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.21ubuntu3.2"}]}],"versions":["1.22.18ubuntu2","1.22.18ubuntu3","1.22.21ubuntu1","1.22.21ubuntu3","1.22.21ubuntu3.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.21-160000.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"update-alternatives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.21-160000.3.1"}]}]}],"products":[{"vendor":"debian","product":"dpkg"}],"references":[{"url":"https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=6610297a62c0780dd0e80b0e302ef64fdcc9d313","tags":["patch","Patch","fix"]},{"url":"https://bugs.debian.org/1129722","tags":["issue-tracking","Issue Tracking","Mailing List","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2219","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x8w5-j8fh-hpvp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-2219","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2219.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-2219","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0144.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35489","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3QFBK2ZJ4T5BTAWBSDBQLVRZQKJEAJEX/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620766-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259385","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2219","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620795-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622046-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622085-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-2219","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2219","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8249-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-2219","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","status":"published","published":"2026-03-07T08:10:53.207Z","modified":"2026-03-09T14:52:18.435Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T13:48:46.911326Z"}],"euvd":[{"id":"EUVD-2026-10138","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","status":"published","published":"2026-03-07T08:10:53Z","modified":"2026-03-09T14:52:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:07.128863Z"}],"ghsa":[{"id":"GHSA-x8w5-j8fh-hpvp","title":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does...","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","status":"published","published":"2026-03-07T09:30:15Z","modified":"2026-03-09T15:30:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:06:30.929454Z"}],"nvd":[{"id":"CVE-2026-2219","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","status":"published","published":"2026-03-07T09:16:07.823Z","modified":"2026-06-17T10:30:34.29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"ALPINE-CVE-2026-2219","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","status":"withdrawn","published":"2026-03-07T09:16:07.823Z","modified":"2026-07-14T08:03:34.408312449Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2026-2219","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","status":"published","published":"2026-03-07T08:10:53.207Z","modified":"2026-10-28T10:51:10.387116007Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"DEBIAN-CVE-2026-2219","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","status":"published","published":"2026-03-07T09:16:07.823Z","modified":"2026-10-01T03:03:08.542061295Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"UBUNTU-CVE-2026-2219","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","status":"published","published":"2026-03-07T09:16:00Z","modified":"2026-05-08T13:26:08.075003Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"AZL-79509","title":"CVE-2026-2219 affecting package dpkg 1.20.10-1","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).","status":"published","published":"2026-03-07T09:16:07Z","modified":"2026-04-21T04:34:45.586589Z","updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"MGASA-2026-0144","title":"Updated dpkg packages fix security vulnerabilities","description":"It was discovered that dpkg-deb (a component of dpkg, the Debian package\nmanagement system) does not properly validate the end of the data stream\nwhen uncompressing a zstd-compressed .deb archive, which may result in\ndenial of service (infinite loop spinning the CPU).\n","status":"published","published":"2026-05-16T06:17:43Z","modified":"2026-05-16T06:30:19.328089Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10675-1","title":"dpkg-1.22.22-1.1 on GA media","description":"These are all security issues fixed in the dpkg-1.22.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-04T00:00:00Z","modified":"2026-05-05T07:46:27.546121Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20909-1","title":"Security update for dpkg","description":"This update for dpkg fixes the following issue:\n\n- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).\n","status":"published","published":"2026-06-05T13:47:06Z","modified":"2026-06-09T18:24:24.000564857Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-2219","title":"CVE-2026-2219 in rootio-dpkg - Patched by Root","description":"Root has patched CVE-2026-2219 in the rootio-dpkg package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-03-23T11:33:36Z","modified":"2026-08-20T14:00:14.297760367Z","updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"SUSE-SU-2026:20766-1","title":"Security update for dpkg","description":"This update for dpkg fixes the following issue:\n\n- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).\n","status":"published","published":"2026-03-19T11:22:45Z","modified":"2026-03-25T17:33:50.421414Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20795-1","title":"Security update for dpkg","description":"This update for dpkg fixes the following issue:\n\n- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).\n","status":"published","published":"2026-03-19T12:23:49Z","modified":"2026-03-25T17:23:51.01627Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:22046-1","title":"Security update for dpkg","description":"This update for dpkg fixes the following issue:\n\n- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).\n","status":"published","published":"2026-06-05T13:51:45Z","modified":"2026-06-10T18:24:10.716653891Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22085-1","title":"Security update for dpkg","description":"This update for dpkg fixes the following issue:\n\n- CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).\n","status":"published","published":"2026-06-05T13:51:45Z","modified":"2026-06-16T18:24:38.545415263Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"USN-8249-1","title":"dpkg vulnerability","description":"Yashashree Gund discovered that the dpkg dpkg-deb tool incorrectly handled\ncertain zstd-compressed .deb archives. If a user or automated system were\ntricked into manipulating a specially crafted .deb archive, a remote\nattacker could possibly use this issue to cause dpkg-deb to stop\nresponding, resulting in a denial of service.","status":"published","published":"2026-05-07T13:16:26Z","modified":"2026-05-08T13:29:35.231035848Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}