CVE-2026-48959

Name	CVE-2026-48959
Description	IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1138051, 1138856

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libio-compress-perl (PTS)	bullseye	2.101-1	vulnerable
	bookworm	2.204-1	vulnerable
	trixie	2.213-1	vulnerable
	forky, sid	2.220-1	fixed
perl (PTS)	bullseye	5.32.1-4+deb11u3	vulnerable
	bullseye (security)	5.32.1-4+deb11u5	vulnerable
	bookworm	5.36.0-7+deb12u3	vulnerable
	bookworm (security)	5.36.0-7+deb12u2	vulnerable
	trixie	5.40.1-6	vulnerable
	forky, sid	5.40.1-8	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libio-compress-perl	source	(unstable)	2.220-1			1138051
perl	source	(unstable)	5.40.1-8			1138856

Notes

https://lists.security.metacpan.org/cve-announce/msg/40434381/
Fixed by: https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2 (v2.220)