It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
References
| Link | Resource |
|---|---|
| https://bugs.debian.org/1129722 | Issue Tracking Mailing List |
| https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=6610297a62c0780dd0e80b0e302ef64fdcc9d313 | Patch |
Configurations
Configuration 1 (hide)
|
History
02 Jun 2026, 19:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugs.debian.org/1129722 - Issue Tracking, Mailing List | |
| References | () https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=6610297a62c0780dd0e80b0e302ef64fdcc9d313 - Patch | |
| First Time |
Debian
Debian dpkg |
|
| CPE | cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:* | |
| Summary |
|
09 Mar 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-835 |
07 Mar 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Mar 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-07 09:16
Updated : 2026-06-02 19:12
NVD link : CVE-2026-2219
Mitre link : CVE-2026-2219
CVE.ORG link : CVE-2026-2219
JSON object : View
Products Affected
debian
- dpkg
CWE
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')