CVE-2026-48959: IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl IO::Uncompress::Unzipto a version that resolves this vulnerability.Fixed in 2.220 - Compensating control
As a mitigation until patched, avoid extracting attacker-supplied ZIP entries using IO::Uncompress::Unzip->new($zip, Name => $target) / IO::Uncompress::Unzip->new($zip, Name => $target), since extraction of a named entry drives a per-byte read loop scaling with the entry's compressed size (up to the non-Zip64 4 GiB cap).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48959?
CVE-2026-48959 is rated with a risk score of 30.
How do I fix CVE-2026-48959?
To fix CVE-2026-48959, upgrade to IO-Compress version 2.220 or later.
What versions are affected by CVE-2026-48959?
CVE-2026-48959 affects all versions of IO::Uncompress::Unzip for Perl before 2.220.
What kind of vulnerability is CVE-2026-48959?
CVE-2026-48959 is a vulnerability that allows CPU exhaustion due to a poor implementation in the fastForward function.
Who is impacted by CVE-2026-48959?
Users of IO::Uncompress::Unzip versions prior to 2.220 for Perl are impacted by CVE-2026-48959.