CVE-2026-48959: pmqs io::uncompress::unzip Inefficient Algorithmic Complexity

Vulnerability summary

CVE-2026-48959 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in pmqs io::uncompress::unzip. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.4% of scored vulnerabilities.

Timeline

1. 27-05-2026
   PublishedVulnerability first disclosed.
2. 29-05-2026
   Last modifiedVulnerability information updated.

Description

IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.

• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.