It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not
    properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may
    result in denial of service (infinite loop spinning the CPU). (CVE-2026-2219)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20909-1 advisory.

    This update for dpkg fixes the following issue:

    - CVE-2026-2219: dpkg-deb: malformed .deb archives can cause a denial of service (bsc#1259385).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8249-1 advisory.

    Yashashree Gund discovered that the dpkg dpkg-deb tool incorrectly handled certain zstd-compressed .deb     archives. If a user or automated system were tricked into manipulating a specially crafted .deb archive, a     remote attacker could possibly use this issue to cause dpkg-deb to stop responding, resulting in a denial     of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
462872	Echo: dpkg: security update to 1.22.21+e1	Tenable Cloud Security	Echo Local Security Checks	Local	high
462872	Echo: dpkg: security update to 1.22.21+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
320413	openSUSE 16 Security Update : dpkg (openSUSE-SU-2026:20909-1)	Nessus	SuSE Local Security Checks	Local	high
314220	Ubuntu 24.04 LTS / 25.10 : dpkg vulnerability (USN-8249-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2026-2219

high

Tenable Plugins

high

high

high

high