High
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward
Type: advisorySources: OSV
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-48959
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 16:38 UTC · Revision 1
Source evidence
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward
core-osv · Original sourcePublished 27 May 2026, 02:29 UTC
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.
osv:CVE-2026-48959
Complete source record
{
"id": "3c9b1e8679c8bb80d18711c74083517c4ce132f9ad2e0a5cc51791c686b7ebf2",
"url": "https://osv.dev/vulnerability/CVE-2026-48959",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward",
"summary": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.",
"evidence": "osv:CVE-2026-48959",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-48959",
"aliases": [
"CVE-2026-48959"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/pmqs/io-compress",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "f1979570091697409f4792e5d401bbf8fb4b20b6"
},
{
"fixed": "68db44076f4c1a86a2ffe53a958eac6cabaf72e2"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.220"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "68db44076f4c1a86a2ffe53a958eac6cabaf72e2"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2.219",
"v2.218",
"v2.217",
"v2.216",
"v2.215",
"v2.214",
"v2.213",
"v2.212",
"v2.211",
"v2.208",
"v2.207",
"v2.206",
"v2-205",
"v2.204",
"v2.201",
"v2.106",
"v2.105",
"v2.103",
"v2.102",
"v2.101",
"v2.100",
"v2.096",
"v2.095",
"v2.093",
"v2.092",
"v2.091",
"v2.090",
"v2.089",
"v2.088",
"v2.087",
"v2.086",
"v2.084",
"v2.083",
"v2.082",
"v2.081",
"v2.080",
"v2.074",
"v2.073",
"v2.072",
"v2.070",
"v2.069",
"v2.068",
"v2.067",
"v2.066",
"v2.064",
"v2.063",
"v2.062",
"v2.061",
"v2.060",
"v2.059",
"v2.058",
"v2.057",
"v2.055",
"v2.052",
"v2.049",
"v2.048",
"v2.047",
"v2.046",
"v2.045",
"v2.044",
"v2.043",
"v2.042",
"v2.040",
"v2.039",
"v2.037",
"v2.036",
"v2.035",
"v2.034",
"v2.033",
"v2.032",
"v2.030",
"v2.027",
"v2.026",
"v2.025",
"v2.024",
"v2.023",
"v2.022",
"v2.021",
"v2.020",
"v2.019",
"v2.018",
"v2.017",
"v2.015",
"v2.014",
"v2.012",
"v2.011",
"v2.010",
"v2.008",
"v2.007",
"v2.006",
"v2.005",
"v2.004",
"v2.003",
"v2.002",
"v2.001",
"v2.000_14",
"v2.000_13",
"v2.000_12",
"v2.000_11",
"v2.000_10",
"v2.000_09",
"v2.000_07",
"v2.000_06",
"v2.000_05",
"v2.000_04",
"v2.000_03",
"v2.000_02",
"v2.000_00"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48959.json"
}
}
],
"modified": "2026-10-28T02:30:37.469100503Z",
"provider": "osv",
"references": [
"https://cpan.org/modules",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48959.json",
"https://metacpan.org/release/PMQS/IO-Compress-2.220/changes",
"https://nvd.nist.gov/vuln/detail/CVE-2026-48959",
"https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch",
"https://github.com/pmqs/IO-Compress"
],
"provider_metadata": {
"cwe_ids": [
"CWE-407"
],
"cna_assigner": "CPANSec",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48959.json"
}
},
"related_cves": [
{
"value": "CVE-2026-48959",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504780,
"published_at": "2026-05-27T02:29:07.027+00:00"
}