CVE-2026-48959 Details
Description
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.
A denial-of-service vulnerability has been identified in IO::Uncompress::Unzip versions prior to 2.220 for Perl. The issue arises from a per-byte read loop in the fastForward.fastForward() method, which improperly compares the length of the offset with the chunk size. This flaw allows the chunk size to shrink dramatically, leading to excessive CPU consumption. The vulnerability can be exploited by extracting a named entry from a zip file supplied by an attacker, causing the read loop to scale with the entry's compressed size, potentially reaching up to 4 GiB.
Users should update to IO::Uncompress::Unzip version 2.220 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/PMQS/IO-Compress-2.220/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/27/2 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| IO::Uncompress::Unzip | < 2.220 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| May 29, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CVE |
| May 27, 2026 | New CVE Received | CPANSec |