Is CVE-2026-2219 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2219 being exploited in the wild.

How severe is CVE-2026-2219?

High severity, with a CVSS score of 7.5, published 7 March 2026.

Which products and versions are affected?

Debian Dpkg 1.21.18 to 1.21.22, 1.22.0 to 1.22.21, 1.23.0 to 1.23.5.

Is there a fix for CVE-2026-2219?

A patch was published on 2026-03-05: Fixed in dpkg version 1.23.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2219 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-2219?

Check whether you run Debian Dpkg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2219: Debian dpkg infinite loop in zstd decompression

CVE-2026-2219 · Severity: high · CVSS 7.5 · Published 2026-03-07

A vulnerability was found in dpkg-deb, a core tool used to manage software packages on Debian-based systems like Ubuntu. By providing a specially crafted, malformed package file, an attacker can cause the system to hang indefinitely while trying to process it. This can disrupt automated software updates, security scanners, and development pipelines, potentially requiring manual intervention to restore service.

Vendors: Debian.

Quick answers

Is CVE-2026-2219 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2219 being exploited in the wild.
How severe is CVE-2026-2219?: High severity, with a CVSS score of 7.5, published 7 March 2026.
Which products and versions are affected?: Debian Dpkg 1.21.18 to 1.21.22, 1.22.0 to 1.22.21, 1.23.0 to 1.23.5.
Is there a fix for CVE-2026-2219?: A patch was published on 2026-03-05: Fixed in dpkg version 1.23.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2219 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-2219?: Check whether you run Debian Dpkg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service (DoS) vulnerability exists in dpkg-deb due to improper validation of the data stream end during the decompression of zstd-compressed .deb archives. Specifically, when a .deb archive header declares a compressed control archive size that exceeds the actual provided data, a producer-consumer deadlock occurs between the parent dpkg process and the child decompressor. This results in an infinite loop (CWE-835) that consumes CPU resources and stalls the process. The vulnerability can be triggered by any operation that inspects or installs a malicious package, such as 'dpkg-deb --info'. Patches have been released in dpkg versions 1.23.6 and 1.22.22.

Affected products

Debian dpkg 1.21.18 to 1.21.22, 1.22.0 to 1.22.21, 1.23.0 to 1.23.5

Timeline

2026-03-05: disclosed: Bug reported to Debian by Yashashree Gund
2026-03-05: patched: Fixed in dpkg version 1.23.6
2026-03-07: advisory: CVE-2026-2219 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.