Advisories » MGASA-2026-0144

Updated dpkg packages fix security vulnerabilities

Publication date: 16 May 2026
Modification date: 16 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-2219

Description

It was discovered that dpkg-deb (a component of dpkg, the Debian package
management system) does not properly validate the end of the data stream
when uncompressing a zstd-compressed .deb archive, which may result in
denial of service (infinite loop spinning the CPU).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=35489
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3QFBK2ZJ4T5BTAWBSDBQLVRZQKJEAJEX/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2219

SRPMS

9/core

• dpkg-1.22.22-1.mga9