p PatchFirst

CVE-2026-2219

CVE-2026-2219

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

CVSS 7.5 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dpkg

    Versions
    • ≥ 1.21.18, < 1.23.6: Affected (semver)

    Update to 1.23.6

  • dpkg Debian:12

    Versions
    • 1.21.22
    Affected ranges
    • ECOSYSTEM: < 1.21.23

    Update to 1.21.23

  • dpkg Debian:13

    Versions
    • 1.22.21
    Affected ranges
    • ECOSYSTEM: < 1.22.22

    Update to 1.22.22

  • dpkg Debian:14

    Versions
    • 1.22.21
    • 1.22.22
    • 1.23.0
    • 1.23.1
    • 1.23.2
    • 1.23.3
    • 1.23.4
    • 1.23.5
    Affected ranges
    • ECOSYSTEM: < 1.23.6

    Update to 1.23.6

  • dpkg Ubuntu:24.04:LTS

    Versions
    • 1.22.0ubuntu1
    • 1.22.1ubuntu2
    • 1.22.1ubuntu3
    • 1.22.1ubuntu5
    • 1.22.2ubuntu2
    • 1.22.4ubuntu3
    • 1.22.4ubuntu5
    • 1.22.6ubuntu5
    • 1.22.6ubuntu6
    • 1.22.6ubuntu6.1
    • 1.22.6ubuntu6.2
    • 1.22.6ubuntu6.5
    Affected ranges
    • ECOSYSTEM: < 1.22.6ubuntu6.6

    Update to 1.22.6ubuntu6.6

  • dpkg Ubuntu:25.10

    Versions
    • 1.22.18ubuntu2
    • 1.22.18ubuntu3
    • 1.22.21ubuntu1
    • 1.22.21ubuntu3
    • 1.22.21ubuntu3.1
    Affected ranges
    • ECOSYSTEM: < 1.22.21ubuntu3.2

    Update to 1.22.21ubuntu3.2

Original sources

Check your server →