8.2

CVE-2025-6297: debian dpkg Uncontrolled Resource Consumption

CVSS: 8.2v3.1HighModified
AliasesMGASA-2025-0204SUSE-SU-2025:02734-1SUSE-SU-2025:20562-1
Published 01-07-2025Last modified 08-07-2026
Open JSON

Vulnerability summary

CVE-2025-6297 is a high (CVSS 8.2) Uncontrolled Resource Consumption vulnerability in debian dpkg. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.6% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v3.1 (CVE.org)
EPSS score
0.41%
0%100%
Low · +0.06 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 01-07-2025
    PublishedVulnerability first disclosed.
  2. 08-07-2026
    Last modifiedVulnerability information updated.

Description

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.41%

Chance of exploitation in the next 30 days

Percentile

34%

Versus all other CVEs

30-day change

+0.06 pp

From 0.35% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.41%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse11 products
  • dpkg&distro=SUSE Linux Enterprise Module for Development Tools 15 SP6< 1.19.0.4-150000.4.7.1
  • dpkg&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7< 1.19.0.4-150000.4.7.1
  • update-alternatives&distro=SUSE Linux Enterprise Micro 5.1< 1.19.0.4-150000.4.7.1
  • update-alternatives&distro=SUSE Linux Enterprise Micro 5.2< 1.19.0.4-150000.4.7.1
  • update-alternatives&distro=SUSE Linux Enterprise Micro 5.3< 1.19.0.4-150000.4.7.1
Opensuse3 products
  • dpkg&distro=openSUSE Leap 15.6< 1.19.0.4-150000.4.7.1
  • dpkg&distro=openSUSE Tumbleweed< 1.22.21-1.1
  • update-alternatives&distro=openSUSE Leap 15.6< 1.19.0.4-150000.4.7.1
Debian2 products
  • dpkg< 1.21.23 | < 1.22.21
  • dpkg< ed6bbd445dd8800308c67236ba35d08004c98e82 | < 1.22.21
Mageia1 product
  • dpkg< 1.22.21-1.mga9
Ubuntu1 product
  • dpkgAll versions (No fix recorded) | < 1.22.21ubuntu1 | < 1.21.1ubuntu2.6 | < 1.22.6ubuntu6.5

5 vendors · 18 products

References

14 links
Show all 14 references