========================================================================
CVE-2026-48959                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-48959
  Distribution:  IO-Compress
      Versions:  before 2.220

      MetaCPAN:  https://metacpan.org/dist/IO-Compress
      VCS Repo:  https://github.com/pmqs/IO-Compress

IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU
exhaustion via per-byte read loop in fastForward

Description
-----------
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU
exhaustion via per-byte read loop in fastForward.

fastForward() compares length $offset (the digit count of the offset, 1
to 19) against the chunk size $c instead of $offset itself, so $c
shrinks from 16 KiB to 1-19 bytes per iteration.

Extracting a named entry from an attacker supplied zip via
IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte
read loop scaling with the entry's compressed size, up to the non-Zip64
4 GiB cap.

Problem types
-------------
- CWE-407 Inefficient Algorithmic Complexity

Solutions
---------
Upgrade to IO-Compress 2.220 or later.

References
----------
https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch
https://metacpan.org/release/PMQS/IO-Compress-2.220/changes

Timeline
--------
- 2026-05-14: Issue reported.
- 2026-05-16: Version 2.220 released.