Every CVE Search/ Get API key

CVE-2025-15649

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date

5.5 MediumFix available

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.13%Up 0.1 points since May 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.5

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Record
CVE-2025-15649
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
EUVDEUVD-2025-209949 5.5

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Record
EUVD-2025-209949
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hcq9-8v5x-mqjp 5.5

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing...

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Record
GHSA-hcq9-8v5x-mqjp
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
NVD 5.5

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Record
CVE-2025-15649
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSVALPINE-CVE-2025-15649 5.5

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Record
ALPINE-CVE-2025-15649
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2025-15649 5.5
Record
BELL-CVE-2025-15649
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 14 moreShow less
OSV 5.5

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Record
CVE-2025-15649
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSVDEBIAN-CVE-2025-15649 5.5

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Record
DEBIAN-CVE-2025-15649
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-15649 5.5

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Record
UBUNTU-CVE-2025-15649
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-89283 No score

CVE-2025-15649 affecting package perl for versions less than 5.38.2-512

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Record
AZL-89283
Updated
2026-11-05
OSVMGASA-2026-0158 No score

Updated perl-IO-Compress package fixes security vulnerabilities

The updated package fixes security vulnerabilities: IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. (CVE-2025-15649) IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. (CVE-2026-48959) IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. (CVE-2026-48962)

Record
MGASA-2026-0158
Updated
2026-11-02
OSVopenSUSE-SU-2026:21411-1 No score

Security update for perl

This update for perl fixes the following issues:

  • CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
  • CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
  • CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
  • CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
  • CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).
Record
openSUSE-SU-2026:21411-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2025-15649 No score

CVE-2025-15649 in perl - Patched by Root

Root has patched CVE-2025-15649 in the perl package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2025-15649
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2025-15649 No score

CVE-2025-15649 in perl - Patched by Root

Root has patched CVE-2025-15649 in the perl package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2025-15649
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2025-15649 No score

CVE-2025-15649 in perl - Patched by Root

Root has patched CVE-2025-15649 in the perl package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2025-15649
Updated
2026-11-02
OSVSUSE-SU-2026:22847-1 No score

Security update for perl

This update for perl fixes the following issues:

  • CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
  • CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
  • CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
  • CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
  • CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).
Record
SUSE-SU-2026:22847-1
Updated
2026-11-02
OSVSUSE-SU-2026:22929-1 No score

Security update for perl

This update for perl fixes the following issues:

  • CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
  • CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
  • CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
  • CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
  • CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).
Record
SUSE-SU-2026:22929-1
Updated
2026-11-02
OSVSUSE-SU-2026:23008-1 No score

Security update for perl

This update for perl fixes the following issues

  • CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
  • CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
  • CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
  • CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
  • CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).
Record
SUSE-SU-2026:23008-1
Updated
2026-11-02
OSVSUSE-SU-2026:23075-1 No score

Security update for perl

This update for perl fixes the following issues

  • CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
  • CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
  • CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
  • CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
  • CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).
Record
SUSE-SU-2026:23075-1
Updated
2026-11-02
OSVUSN-8684-1 No score

perl vulnerabilities

It was discovered that Perl incorrectly handled certain arguments to Socket and pack/unpack functions. An attacker could possibly use this issue to read sensitive information from memory. (CVE-2026-12087, CVE-2026-57432)

It was discovered that Perl incorrectly handled regular expressions with a large number of alternation branches. An attacker could possibly use this issue to cause incorrect matching results. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-57433, CVE-2025-15649, CVE-2026-48959, CVE-2026-9538)

It was discovered that Perl incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-48962)

It was discovered that Perl incorrectly handled credential headers during cross-origin redirects in HTTP::Tiny. An attacker could possibly use this issue to expose sensitive information. (CVE-2026-7017)

Record
USN-8684-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
perl
Alpine:v3.24
 before 5.42.3-r0
5.42.3-r0
perl
Azure Linux:3
 before 5.38.2-512
5.38.2-512
perl
Alpaquita:23
 5.36.0-r0 up to 5.36.3-r2
5.36.3-r2
perl
Alpaquita:25
 5.40.2-r0 up to 5.40.4-r1
5.40.4-r1
perl
Alpaquita:stream
 5.36.0-r0 up to 5.42.2-r1
5.42.2-r1
perl
BellSoft Hardened Containers:23
 5.36.0-r0 up to 5.36.3-r2
5.36.3-r2
perl
BellSoft Hardened Containers:25
 5.40.2-r0 up to 5.40.4-r1
5.40.4-r1
perl
BellSoft Hardened Containers:stream
 5.36.0-r0 up to 5.42.2-r1
5.42.2-r1
libio-compress-perl
Debian:12
 before 2.204-1+deb12u1, plus listed versions
2.204-1
2.204-1+deb12u1
libio-compress-perl
Debian:13
 before 2.213-1+deb13u1, plus listed versions
2.213-1
2.213-1+deb13u1
Show 29 moreShow less
Affected packages
PackageAffectedFixed
libio-compress-perl
Debian:14
 before 2.217-1, plus listed versions
2.213-12.214-1
2.217-1
perl
Debian:12
 before 5.36.0-7+deb12u4, plus listed versions
5.36.0-75.36.0-7+deb12u15.36.0-7+deb12u25.36.0-7+deb12u3
5.36.0-7+deb12u4
perl
Debian:13
 before 5.40.1-6+deb13u1, plus listed versions
5.40.1-6
5.40.1-6+deb13u1
perl
Debian:14
 before 5.40.1-8, plus listed versions
5.40.1-65.40.1-7
5.40.1-8
perl-IO-Compress
Mageia:9
From an advisory covering 4 CVEs
 before 2.204.0-1.1.mga9
2.204.0-1.1.mga9
perl
Root:Debian:11
 before 5.32.1-4+deb11u5.aikido.6
5.32.1-4+deb11u5.aikido.65.32.1-4+deb11u5.aikido.75.32.1-4+deb11u5.aikido.85.32.1-4+deb11u5.aikido.95.32.1-4+deb11u5.aikido.105.32.1-4+deb11u5.aikido.115.32.1-4+deb11u5.aikido.125.32.1-4+deb11u5.root.io.5
rootio-perl
Root:Debian:11
 before 5.32.1-4+deb11u5.aikido.6
5.32.1-4+deb11u5.aikido.65.32.1-4+deb11u5.aikido.75.32.1-4+deb11u5.aikido.85.32.1-4+deb11u5.aikido.95.32.1-4+deb11u5.aikido.105.32.1-4+deb11u5.aikido.115.32.1-4+deb11u5.aikido.125.32.1-4+deb11u5.root.io.5
perl
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 5.42.0-160000.3.1
5.42.0-160000.3.1
perl
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 5.42.0-160000.3.1
5.42.0-160000.3.1
perl
SUSE:Linux Micro 6.2
From an advisory covering 5 CVEs
 before 5.42.0-160000.3.1
5.42.0-160000.3.1
perl
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
 before 5.38.2-5.1
5.38.2-5.1
perl
SUSE:Linux Micro 6.1
From an advisory covering 5 CVEs
 before 5.38.2-slfo.1.1_3.1
5.38.2-slfo.1.1_3.1
perl
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
5.14.2-21build15.18.1-45.18.1-4build15.18.1-55.18.2-2
Show 12 moreShow less
5.18.2-2ubuntu15.18.2-2ubuntu1.15.18.2-2ubuntu1.35.18.2-2ubuntu1.45.18.2-2ubuntu1.65.18.2-2ubuntu1.75.18.2-2ubuntu1.7+esm35.18.2-2ubuntu1.7+esm45.18.2-2ubuntu1.7+esm55.18.2-2ubuntu1.7+esm75.18.2-2ubuntu1.7+esm85.18.2-2ubuntu1.7+esm9
 None known
perl
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.20.2-65.22.1-35.22.1-45.22.1-55.22.1-7
Show 11 moreShow less
5.22.1-85.22.1-95.22.1-9ubuntu0.25.22.1-9ubuntu0.35.22.1-9ubuntu0.55.22.1-9ubuntu0.65.22.1-9ubuntu0.95.22.1-9ubuntu0.9+esm15.22.1-9ubuntu0.9+esm25.22.1-9ubuntu0.9+esm35.22.1-9ubuntu0.9+esm4
 None known
libio-compress-perl
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.068-22.069-1
 None known
perl
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.26.0-8ubuntu15.26.1-2ubuntu15.26.1-35.26.1-45.26.1-4build1
Show 11 moreShow less
5.26.1-55.26.1-65.26.1-6ubuntu0.15.26.1-6ubuntu0.25.26.1-6ubuntu0.35.26.1-6ubuntu0.55.26.1-6ubuntu0.65.26.1-6ubuntu0.75.26.1-6ubuntu0.7+esm25.26.1-6ubuntu0.7+esm35.26.1-6ubuntu0.7+esm4
 None known
libio-compress-perl
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.074-1
 None known
perl
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.28.1-6build15.30.0-75.30.0-95.30.0-9build15.30.0-9ubuntu0.2
Show 6 moreShow less
5.30.0-9ubuntu0.35.30.0-9ubuntu0.45.30.0-9ubuntu0.55.30.0-9ubuntu0.5+esm25.30.0-9ubuntu0.5+esm35.30.0-9ubuntu0.5+esm4
 None known
libio-compress-perl
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.087-12.089-12.090-12.093-1
 None known
libio-compress-perl
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.101-12.102-1
 None known
perl
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.32.1-3ubuntu35.34.0-3ubuntu15.34.0-3ubuntu1.15.34.0-3ubuntu1.25.34.0-3ubuntu1.3
Show 5 moreShow less
5.34.0-3ubuntu1.45.34.0-3ubuntu1.55.34.0-3ubuntu1.75.34.0-3ubuntu1.85.34.0-3ubuntu1.9
 None known
libio-compress-perl
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.206-12.207-1
 None known
perl
Ubuntu:24.04:LTS
 before 5.38.2-3.2ubuntu0.4, plus listed versions
5.36.0-9ubuntu15.36.0-10ubuntu15.38.2-35.38.2-3.25.38.2-3.2build1
Show 5 moreShow less
5.38.2-3.2build25.38.2-3.2build2.15.38.2-3.2ubuntu0.15.38.2-3.2ubuntu0.25.38.2-3.2ubuntu0.3
5.38.2-3.2ubuntu0.4
libio-compress-perl
Ubuntu:25.10
 All versions, plus listed versions
2.213-1
 None known
perl
Ubuntu:25.10
 All versions, plus listed versions
5.40.1-25.40.1-35.40.1-55.40.1-65.40.1-6build15.40.1-6ubuntu0.1
 None known
perl
Ubuntu:26.10
 All versions, plus listed versions
5.40.1-7build15.40.1-85.40.1-8ubuntu15.42.3-1
 None known
perl
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.40.1-6build15.40.1-7build15.40.1-7ubuntu0.15.40.1-7ubuntu0.25.40.1-7ubuntu0.3
 None known
perl
Ubuntu:24.04:LTS
From an advisory covering 9 CVEs
 before 5.38.2-3.2ubuntu0.4, plus listed versions
5.36.0-9ubuntu15.36.0-10ubuntu15.38.2-35.38.2-3.25.38.2-3.2build1
Show 5 moreShow less
5.38.2-3.2build25.38.2-3.2build2.15.38.2-3.2ubuntu0.15.38.2-3.2ubuntu0.25.38.2-3.2ubuntu0.3
5.38.2-3.2ubuntu0.4
perl
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 5.42.0-160000.3.1
5.42.0-160000.3.1

History

History
RecordedChangedSources
affectedOSV
affected, aliases, facts, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-15649 is a medium vulnerability (CVSS 5.5) in Pmqs Io::uncompress::unzip, published May 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in perl 5.42.3-r0.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open