CVE-2026-2219

Description

It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

PUBLISHED Reserved 2026-02-08 | Published 2026-03-07 | Updated 2026-03-07 | Assigner debian

Product status

Credits

Yashashree Gund reporter

References

git.dpkg.org/...?id=6610297a62c0780dd0e80b0e302ef64fdcc9d313 patch

bugs.debian.org/1129722 issue-tracking

cve.org (CVE-2026-2219)

nvd.nist.gov (CVE-2026-2219)

Download JSON