It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
References
Configurations
No configuration.
History
09 Mar 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-835 |
07 Mar 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Mar 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-07 09:16
Updated : 2026-03-09 15:15
NVD link : CVE-2026-2219
Mitre link : CVE-2026-2219
CVE.ORG link : CVE-2026-2219
JSON object : View
Products Affected
No product.
CWE
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')