7.5

CVE-2026-2219: debian dpkg Infinite Loop

CVSS: 7.5v3.1HighAnalyzed
AliasesALPINE-CVE-2026-2219MGASA-2026-0144SUSE-SU-2026:20766-1
Published 07-03-2026Last modified 09-03-2026
Open JSON

Vulnerability summary

CVE-2026-2219 is a high (CVSS 7.5) Infinite Loop vulnerability in debian dpkg. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.3% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.43%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 07-03-2026
    PublishedVulnerability first disclosed.
  2. 09-03-2026
    Last modifiedVulnerability information updated.

Description

It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

+0.01 pp

From 0.42% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse7 products
  • dpkg&distro=SUSE Linux Enterprise Server 16.0< 1.22.21-160000.3.1
  • dpkg&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 1.22.21-160000.3.1
  • update-alternatives&distro=SUSE Linux Enterprise Server 16.0< 1.22.21-160000.3.1
  • update-alternatives&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 1.22.21-160000.3.1
  • update-alternatives&distro=SUSE Linux Micro 6.0< 1.22.0-3.1
Opensuse3 products
  • dpkg&distro=openSUSE Leap 16.0< 1.22.21-160000.3.1
  • dpkg&distro=openSUSE Tumbleweed< 1.22.22-1.1
  • update-alternatives&distro=openSUSE Leap 16.0< 1.22.21-160000.3.1
Debian2 products
  • dpkg< 1.21.23 | < 1.22.22 | < 1.23.6
  • dpkg≥ 1.21.18, < 1.23.6 | ≥ 1.21.18, < 1.21.23 | ≥ 1.22.0, < 1.22.22 | ≥ 1.23.0, < 1.23.6
Alpine1 product
  • dpkg≥ 1.21.18 (No fix recorded)
Mageia1 product
  • dpkg< 1.22.22-1.mga9
Ubuntu1 product
  • dpkg< 1.22.6ubuntu6.6 | < 1.22.21ubuntu3.2

6 vendors · 15 products

References

16 links
Show all 16 references