Executive brief
A vulnerability in a common Perl library used for decompressing ZIP files can lead to a denial-of-service condition. By providing a specially crafted ZIP archive, an attacker can force the system to consume excessive CPU resources during the extraction process. This can slow down or completely freeze applications that process untrusted file uploads or automated data feeds.
Technical details
A logic error (typo) in the fastForward() function of IO::Uncompress::Unzip causes inefficient algorithmic complexity. The code incorrectly compares the length of the offset string (a value between 1 and 19) against the chunk size instead of using the offset value itself. This causes the chunk size to shrink to a near-singular byte count per iteration, resulting in a per-byte read loop. An attacker can exploit this by providing a ZIP file with a large compressed entry; when a named entry is extracted, the library will perform millions of unnecessary iterations, leading to CPU exhaustion. The issue is fixed in version 2.220.
Affected products
- PMQS (CPAN) IO-Compress (IO::Uncompress::Unzip) before 2.220
Timeline
- 2026-05-15: patched: Fix committed to GitHub repository
- 2026-05-16: other: Version 2.220 released on CPAN
- 2026-05-27: advisory: CVE-2026-48959 published