# CVE-2025-15649: Perl IO::Uncompress::Unzip uncaught exception in DOS date parsing

Source: https://junglewise.ai/threats/cve-2025-15649-perl-io-uncompress-unzip-uncaught-exception-in-dos-date-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2025-15649 · Severity: info · CVSS 0 · Published 2026-05-27

A vulnerability in a common Perl library used for handling ZIP files can cause applications to crash when processing a specially crafted archive. If an application uses this library to automatically process uploaded or external ZIP files, an attacker could provide a file with a malformed date header to trigger a denial-of-service state. This affects the reliability of services that rely on automated file decompression.

Technologies: [Perl CPAN IO-Compress](https://junglewise.ai/threats/technologies/io-compress). Vendors: [Perl CPAN](https://junglewise.ai/threats/vendors/perl-cpan).

## Quick answers

**Is CVE-2025-15649 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-15649 being exploited in the wild.

**How severe is CVE-2025-15649?** Informational severity, with a CVSS score of 0, published 27 May 2026.

**Which products and versions are affected?** Perl CPAN IO-Compress < 2.215.

**Is there a fix for CVE-2025-15649?** A patch was published on 2025-10-25: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-15649 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2025-15649?** Check whether you run Perl CPAN IO-Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `_dosToUnixTime()` function within `IO::Uncompress::Unzip`. The function decodes the last-modification date field from the local-file-header and passes the resulting values to `Time::Local::timelocal()` without an `eval` guard or input validation. If the ZIP header contains a date field that decodes to an out-of-range month, day, or hour, `timelocal()` throws an exception that propagates out of the `IO::Uncompress::Unzip->new()` constructor. This unexpected exception causes the calling Perl script to terminate (die) instead of returning an error code. The issue is resolved in version 2.215 by wrapping the call in an `eval` block.

## Affected products

- Perl CPAN IO-Compress (IO::Uncompress::Unzip) < 2.215

## Timeline

- 2025-10-25: patched: Fix committed to GitHub repository
- 2026-01-31: advisory: Version 2.215 released on CPAN
- 2026-05-27: disclosed: CVE published to NVD

## References

- [https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch](https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch)
- [https://github.com/pmqs/IO-Compress/issues/65](https://github.com/pmqs/IO-Compress/issues/65)
- [https://metacpan.org/release/PMQS/IO-Compress-2.215/changes](https://metacpan.org/release/PMQS/IO-Compress-2.215/changes)

## Related threats

- [Perl IO::Compress crash in zipdetails CLI tool](https://junglewise.ai/threats/cve-2026-48961-perl-io-compress-crash-in-zipdetails-cli-tool)