CVE-2026-48961 Details
Description
IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.
A denial-of-service vulnerability has been identified in the IO::Compress Perl module, specifically in versions 2.207 prior to 2.220. The issue arises in the bundled zipdetails command-line tool when it processes an Info-ZIP Unix Extra Field containing 8-byte UID or GID values. The tool crashes due to a typo in the code, where a subroutine is incorrectly named, leading to an 'undefined subroutine' error. This flaw causes the script to exit with a status of 255.
Users can upgrade to IO::Compress version 2.220 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/PMQS/IO-Compress-2.220/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/27/3 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-755 | Improper Handling of Exceptional Conditions | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| IO::Compress | >= 2.207, < 2.220 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| May 29, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CVE |
| May 27, 2026 | New CVE Received | CPANSec |