CVE-2026-48959

HighCVSS 7.5

Published: 27/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

Vulnerability in the IO::Uncompress::Unzip library for Perl before version 2.220. The fastForward function compares the offset length (1-19 bytes) with the chunk size, causing a per-byte read loop leading to CPU exhaustion. An attacker can supply a crafted zip file.

Risk Assessment

Risk includes CPU resource exhaustion on the server, potentially leading to denial of service (DOS) for applications using this library.

Recommendation

Update IO::Uncompress::Unzip to version 2.220 or later; restrict processing of untrusted zip files.

Other vulnerabilities in IO::Uncompress::Unzip

CVE-2025-15649Medium
Vulnerability in IO::Uncompress::Unzip for Perl before version 2.215. An uncaught exception when parsing a ZIP header with a malformed DOS date causes a crash.

Original NVD description (English source)

IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.