It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade dpkg | Jun 18, 2026 | Mar 7, 2026 |
| Debian | — | Upgrade dpkg | May 17, 2026 | May 17, 2026 |
| Suse | — | Upgrade dpkg-langUpgrade update-alternativesUpgrade dpkg-develUpgrade dpkg | Jun 9, 2026 | Mar 19, 2026 |
| Ubuntu | — | Upgrade dpkg | May 7, 2026 | Mar 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub