CVE-2025-15649

MediumCVSS 5.5

Published: 27/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

Vulnerability in IO::Uncompress::Unzip for Perl before version 2.215. An uncaught exception when parsing a ZIP header with a malformed DOS date causes a crash.

Risk Assessment

An attacker can supply a crafted ZIP file that crashes the application using this library, leading to denial of service.

Recommendation

Update the IO::Uncompress::Unzip library to version 2.215 or later.

Other vulnerabilities in IO::Uncompress::Unzip

CVE-2026-48959High
Vulnerability in the IO::Uncompress::Unzip library for Perl before version 2.220. The fastForward function compares the offset length (1-19 bytes) with the chunk size, causing a per-byte read loop leading to CPU exhaustion. An attacker can supply a crafted zip file.

Original NVD description (English source)

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.