Executive brief
A vulnerability was found in dpkg-deb, a core tool used to manage software packages on Debian-based systems like Ubuntu. By providing a specially crafted, malformed package file, an attacker can cause the system to hang indefinitely while trying to process it. This can disrupt automated software updates, security scanners, and development pipelines, potentially requiring manual intervention to restore service.
Technical details
A denial of service (DoS) vulnerability exists in dpkg-deb due to improper validation of the data stream end during the decompression of zstd-compressed .deb archives. Specifically, when a .deb archive header declares a compressed control archive size that exceeds the actual provided data, a producer-consumer deadlock occurs between the parent dpkg process and the child decompressor. This results in an infinite loop (CWE-835) that consumes CPU resources and stalls the process. The vulnerability can be triggered by any operation that inspects or installs a malicious package, such as 'dpkg-deb --info'. Patches have been released in dpkg versions 1.23.6 and 1.22.22.
Affected products
- Debian dpkg 1.21.18 to 1.21.22, 1.22.0 to 1.22.21, 1.23.0 to 1.23.5
Timeline
- 2026-03-05: disclosed: Bug reported to Debian by Yashashree Gund
- 2026-03-05: patched: Fixed in dpkg version 1.23.6
- 2026-03-07: advisory: CVE-2026-2219 published