CVE-2026-2219

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-07 · updated 2026-06-17
Weakness: CWE-835

Description

It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

Affected products

Debian dpkg: from 1.21.18 before 1.21.23; from 1.22.0 before 1.22.22; from 1.23.0 before 1.23.6 — fixed in 1.21.23, 1.22.22, 1.23.6

How to fix

Upgrade to a fixed version: Debian dpkg 1.21.23, 1.22.22, 1.23.6. Check the vendor advisory for mitigations.

References

https://bugs.debian.org/1129722
https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=6610297a62c0780dd0e80b0e302ef64fdcc9d313

Get alerted when CVE-2026-2219 or the next vulnerability affects your stack