[<prev] [next>] [day] [month] [year] [list]
Message-Id: <7F1B1BCB-FEE1-49FB-B5EE-AD67A2EC8A64@stig.io>
Date: Wed, 27 May 2026 04:32:24 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2026-48959: IO::Uncompress::Unzip versions before 2.220 for Perl
allow CPU exhaustion via per-byte read loop in fastForward
========================================================================
CVE-2026-48959 CPAN Security Group
========================================================================
CVE ID: CVE-2026-48959
Distribution: IO-Compress
Versions: before 2.220
MetaCPAN: https://metacpan.org/dist/IO-Compress
VCS Repo: https://github.com/pmqs/IO-Compress
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU
exhaustion via per-byte read loop in fastForward
Description
-----------
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU
exhaustion via per-byte read loop in fastForward.
fastForward() compares length $offset (the digit count of the offset, 1
to 19) against the chunk size $c instead of $offset itself, so $c
shrinks from 16 KiB to 1-19 bytes per iteration.
Extracting a named entry from an attacker supplied zip via
IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte
read loop scaling with the entry's compressed size, up to the non-Zip64
4 GiB cap.
Problem types
-------------
- CWE-407 Inefficient Algorithmic Complexity
Solutions
---------
Upgrade to IO-Compress 2.220 or later.
References
----------
https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch
https://metacpan.org/release/PMQS/IO-Compress-2.220/changes
Timeline
--------
- 2026-05-14: Issue reported.
- 2026-05-16: Version 2.220 released.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
