{"id":"CVE-2026-48961","aliases":["ALPINE-CVE-2026-48961","BELL-CVE-2026-48961","DEBIAN-CVE-2026-48961","EUVD-2026-32044","GHSA-hjrw-gmwj-xc9c","MGASA-2026-0158","ROOT-OS-DEBIAN-11-CVE-2026-48961","ROOT-OS-DEBIAN-12-CVE-2026-48961","ROOT-OS-DEBIAN-13-CVE-2026-48961","UBUNTU-CVE-2026-48961","openSUSE-SU-2026:10969-1","openSUSE-SU-2026:21177-1"],"status":"published","title":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00262,"percentile":0.1814,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-755"],"published":"2026-05-27T02:34:52Z","modified":"2026-11-11T09:39:57Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl","fixed_in":["5.42.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl","fixed_in":["5.40.4-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl","fixed_in":["5.42.2-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"perl","fixed_in":["5.40.4-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"perl","fixed_in":["5.42.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libio-compress-perl","fixed_in":["2.213-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libio-compress-perl","fixed_in":["2.220-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.40.1-6+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.40.1-8"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"perl","fixed_in":["5.32.1-4+deb11u5.aikido.6","5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.aikido.12","5.32.1-4+deb11u5.root.io.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-perl","fixed_in":["5.32.1-4+deb11u5.aikido.6","5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.aikido.12","5.32.1-4+deb11u5.root.io.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-IO-Compress","fixed_in":["2.220.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.40.2-r0"},{"fixed":"5.40.4-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.42.2-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.40.2-r0"},{"fixed":"5.40.4-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.42.2-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libio-compress-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.213-1+deb13u1"}]}],"versions":["2.213-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libio-compress-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.220-1"}]}],"versions":["2.213-1","2.214-1","2.217-1","2.219-1","2.219-2"]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-6+deb13u1"}]}],"versions":["5.40.1-6"]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-8"}]}],"versions":["5.40.1-6","5.40.1-7"]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-IO-Compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.204.0-1.1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Debian:11","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.6"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.aikido.12"},{"fixed":"5.32.1-4+deb11u5.root.io.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.6"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.aikido.12"},{"fixed":"5.32.1-4+deb11u5.root.io.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7","5.18.2-2ubuntu1.7+esm8","5.18.2-2ubuntu1.7+esm9","5.18.2-2ubuntu1.7+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2","5.22.1-9ubuntu0.9+esm3","5.22.1-9ubuntu0.9+esm4","5.22.1-9ubuntu0.9+esm5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libio-compress-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.068-2","2.069-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2","5.26.1-6ubuntu0.7+esm3","5.26.1-6ubuntu0.7+esm4","5.26.1-6ubuntu0.7+esm5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libio-compress-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.074-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2","5.30.0-9ubuntu0.5+esm3","5.30.0-9ubuntu0.5+esm4","5.30.0-9ubuntu0.5+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libio-compress-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.087-1","2.089-1","2.090-1","2.093-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7","5.34.0-3ubuntu1.8","5.34.0-3ubuntu1.9","5.34.0-3ubuntu1.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libio-compress-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.206-1","2.207-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libio-compress-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.213-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-2","5.40.1-3","5.40.1-5","5.40.1-6","5.40.1-6build1","5.40.1-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libio-compress-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.217-1","2.220-1","2.221-1","2.223-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-7build1","5.40.1-8","5.40.1-8ubuntu1","5.42.3-1","5.42.3-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libio-compress-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.213-1","2.214-1","2.217-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1","5.40.1-7ubuntu0.2","5.40.1-7ubuntu0.3","5.40.1-7ubuntu0.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-IO-Compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.220.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-IO-Compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.220.0-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"pmqs","product":"io::compress"}],"references":[{"url":"https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch","tags":["patch","fix","report"]},{"url":"https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","tags":["release-notes","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/27/3","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48961","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hjrw-gmwj-xc9c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-48961","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-48961","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48961.json","tags":["advisory"]},{"url":"https://github.com/pmqs/IO-Compress","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48961","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0158.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35593","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/27/1","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/27/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/27/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/27/4","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-48961","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48961","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40434383/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48961","tags":["web"]},{"url":"https://bugzilla.suse.com/1266381","tags":["report"]},{"url":"https://bugzilla.suse.com/1266382","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48962","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-48961","title":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","status":"published","published":"2026-05-27T02:34:52.228Z","modified":"2026-05-29T15:52:06.965Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-32044","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","status":"published","published":"2026-05-27T02:34:52Z","modified":"2026-05-29T15:52:06Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:21:00.772434Z"}],"ghsa":[{"id":"GHSA-hjrw-gmwj-xc9c","title":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes...","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","status":"published","published":"2026-05-27T06:31:34Z","modified":"2026-05-29T18:31:16Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:08:23.402135Z"}],"nvd":[{"id":"CVE-2026-48961","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","status":"published","published":"2026-05-27T04:16:31.21Z","modified":"2026-07-24T12:10:00.21Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:12:20.511562Z"}],"osv":[{"id":"ALPINE-CVE-2026-48961","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","status":"published","published":"2026-05-27T04:16:31.21Z","modified":"2026-11-03T19:30:02.595728339Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"BELL-CVE-2026-48961","status":"published","published":"2026-05-29T06:11:00.420562Z","modified":"2026-06-03T07:16:00.392580807Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:24.391068Z"},{"id":"CVE-2026-48961","title":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","status":"published","published":"2026-05-27T02:34:52.228Z","modified":"2026-10-28T02:30:51.680766877Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-48961","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.  When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.  Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","status":"published","published":"2026-05-27T04:16:31.21Z","modified":"2026-10-01T03:03:24.656389959Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"UBUNTU-CVE-2026-48961","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","status":"published","published":"2026-05-27T04:16:00Z","modified":"2026-11-11T09:39:57.151519894Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-11T10:02:01.177747Z"},{"id":"MGASA-2026-0158","title":"Updated perl-IO-Compress package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nIO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught\nexception when parsing zip header with malformed DOS date.\n(CVE-2025-15649)\nIO::Uncompress::Unzip versions before 2.220 for Perl allow CPU\nexhaustion via per-byte read loop in fastForward. (CVE-2026-48959)\nIO::Compress versions before 2.220 for Perl can execute arbitrary code\nin File::GlobMapper via an attacker-controlled output glob.\n(CVE-2026-48962)\n","status":"published","published":"2026-05-29T05:12:50Z","modified":"2026-05-29T05:15:06.863474684Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10969-1","title":"perl-IO-Compress-2.220.0-2.1 on GA media","description":"These are all security issues fixed in the perl-IO-Compress-2.220.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-08T00:00:00Z","modified":"2026-06-09T09:00:05.983504148Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21177-1","title":"Security update for perl-IO-Compress","description":"This update for perl-IO-Compress fixes the following issues:\n\nChanges in perl-IO-Compress:\n\n- updated to 2.220.0 (2.220)\n   see /usr/share/doc/packages/perl-IO-Compress/Changes\n\n    2.220 16 May 2026\n      * remove use of eval in globmapper. #73\n        CVE-2026-48962 bsc#1266382\n      * Update zipdetails to version 4.006.\n        CVE-2026-48961 bsc#1266381\n      * Fix typo in fastForward #72\n      * Fix issue with \"rawdeflate` option in AnyInflate. #71\n\n- updated to 2.219.0 (2.219)\n   see /usr/share/doc/packages/perl-IO-Compress/Changes\n\n    2.219 9 March 2026\n      * Fix a few  typos\n      * Squash repeated semicolons\n      * Make dependent version checking consistent amd update module to version 2.219. Fixes #70\n    2.218 8 March 2026\n      * Refresh zipdetails to version 4.005 Sourced from https://github.com/pmqs/zipdetails\n      * version 2.218\n      * Add SECURITY.md,  Fixes #69\n      * fix spelling typo\n      * Refresh Changes file\n      * Update release date in README\n      * Refresh zipdetails from https://github.com/pmqs/zipdetails\n    2.217 1 February 2026\n      * Update release date in README\n      * Refresh zipdetails from https://github.com/pmqs/zipdetails\n      * Delete GZIP environment variable before running interop tests Fixes #24\n      * Update version to 2.217\n    2.216 31 January 2026\n        * Update version to 2.216\n        * IO::Compress @2.215: t/006zip.t fails due to missing test files #67\n    2.215 31 January 2026\n        * Fix version check in 000prereq.t\n        * Update Changes for 2.215\n        * Update version to 2.215 \u0026 change copyright year to 2026\n        * Add tests for handling zero and invalid datetime values in unzip functionality. Fix for #65\n        * Enhance _dosToUnixTime to handle zero and invalid datetime values; add tests for edge cases. Fixes #65\n\n- updated to 2.214.0 (2.214)\n   see /usr/share/doc/packages/perl-IO-Compress/Changes\n\n    2.214 24 October 2025\n        * version 2.214\n        * IO::Compress::Gzip accidentally modifies the `$EXPORT_TAGS{all}-\u003e@*` of other modules Fixes #64\n        * Fix indentation in Windows workflow YAML\n        * Fix indentation in windows.yml exclude section\n        * Merge pull request #63 from masiuchi/fix/ci-errors\n        * Exclude Perl 5.42 with \"strawberry\" distribution from GitHub Actions\n        * Update FreeBSD image to 14.3 in Cirrus CI\n        * Add dependabot.yml file to police workflow files\n        * Add perl 5.42 to workflow files\n        * Fix for https://github.com/pmqs/Compress-Raw-Zlib/issues/34\n        * #59 fix typos in streamzip\n","status":"published","published":"2026-06-30T09:10:12Z","modified":"2026-07-02T18:24:19.908380058Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-48961","title":"CVE-2026-48961 in perl - Patched by Root","description":"Root has patched CVE-2026-48961 in the perl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:42:48Z","modified":"2026-08-23T10:19:02.363089913Z","updated_at":"2026-11-02T15:53:30.179841Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-48961","title":"CVE-2026-48961 in perl - Patched by Root","description":"Root has patched CVE-2026-48961 in the perl package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T14:31:33Z","modified":"2026-10-08T19:00:05.898386249Z","updated_at":"2026-11-02T15:53:32.298225Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-48961","title":"CVE-2026-48961 in perl - Patched by Root","description":"Root has patched CVE-2026-48961 in the perl package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T16:37:37Z","modified":"2026-09-16T20:00:04.606717419Z","updated_at":"2026-11-02T15:53:33.681527Z"}]}}