It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
CVE-2026-2219
NONE
EPSS 0.02%
Updated Mar 07, 2026
Debian
CVE Details
CVE ID
CVE-2026-2219
Published Date
Mar 07, 2026
Vendor
Debian
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.02%
Likelihood of exploitation in next 30 days
Percentile:
6.3th percentile (higher than 6.3% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory