216.73.217.22

CVE-2026-48959

· Published 27/05/2026 04:16 · Modified 27/05/2026 19:38

Labels: CVE-2026-48959 2026-05-279b29abf9-4ab0-4765-b253-1875cd9b441eCVE-2026-48959CWE-407

Essential information

Published
27/05/2026 04:16
Modified
27/05/2026 19:38
Author
Creator
CISA KEV
No
CWE

Description

IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.

NVD status

Status
Deferred — CVE has been recently published to the CVE List and has been received by the NVD.
Source
9b29abf9-4ab0-4765-b253-1875cd9b441e
NVD
View on NVD

Affected products (CPE)

ProductCPE
perl / io cpe:2.3:a:perl:io::uncompress::unzip:<2.220:*:*:*:*:*:*:*

References