IO::Uncompress::Unzip CVE-2026-48959

The target application must (1) accept ZIP archive content from an untrusted source and (2) instantiate IO::Uncompress::Unzip with the Name => $target option to extract a specific named entry - bulk sequential extraction without Name does not invoke the vulnerable fastForward() seek path in the same way. The attacker-supplied entry must precede the named target in the archive layout and have a large compressed size (impact scales linearly up to the non-Zip64 4 GiB cap, so meaningful CPU starvation requires entries in the hundreds-of-megabytes to multi-gigabyte range). Limiting factors: pure availability impact only (C:N/I:N), no code execution or data exposure; exploitation requires the victim service to actually read the malicious archive, so passive file storage that never invokes the module is unaffected; upload-size limits at the web tier (e.g., nginx client_max_body_size, application-level caps) directly cut the achievable CPU cost.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High) correctly captures the picture: an unauthenticated, low-complexity, network-reachable attack producing only availability impact. EPSS at 0.02% (4th percentile) and the absence of CISA KEV listing indicate this is not seeing opportunistic mass exploitation in the wild, consistent with an algorithmic-complexity DoS that requires a target application to actually parse attacker-supplied ZIPs. The 'Information Disclosure' tag in the input data conflicts with the CVSS vector (C:N) and the description (CPU exhaustion only) - the tag appears mis-applied and should be treated as DoS, not info-disclosure. Real-world priority is moderate: high for services that accept untrusted uploads and process them with IO::Uncompress::Unzip (mail scanners, CI artifact handlers, web upload endpoints), low for batch tooling operating on trusted archives.

An attacker uploads a ZIP file containing a single named entry whose compressed size approaches the 4 GiB non-Zip64 cap to a Perl-based service (for example, a mail attachment scanner, document-conversion endpoint, or CI artifact intake) that calls IO::Uncompress::Unzip->new($zip, Name => $target) to extract a specific member. The fastForward() seek over the preceding bytes degenerates into a per-byte read loop, pinning a worker process at 100% CPU for an extended period; repeating the request across worker slots starves the service and produces a denial of service. No public exploit code has been identified at time of analysis, but the trigger condition is trivially reproducible from the patch diff.