CVE-2026-2219
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
| Vendor | debian |
| Product | dpkg |
| Ecosystems | |
| Industries | Technology |
| Published | Mar 7, 2026 |
| Last Updated | Mar 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for debian dpkg
Be the first to know when new high vulnerabilities affecting debian dpkg are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Debian / dpkg
1.21.18 < 1.23.6
References
Credits
🔍 Yashashree Gund