IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.

The version of perl-IO-Compress installed on the remote host is prior to 2.061-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3355 advisory.

    IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in     fastForward.

    fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c     instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.

    Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name =>     $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB     cap. (CVE-2026-48959)

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an     attacker-controlled output glob.

    _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the     parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in     the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.

    Arbitrary Perl in the output glob executes at the calling process's privilege. (CVE-2026-48962)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1825 advisory.

    IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in     fastForward.

    fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c     instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.

    Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name =>     $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB     cap. (CVE-2026-48959)

    IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with     undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.

    When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID     Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through     decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same     file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and     the script exits with status 255.

    Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI     tool. (CVE-2026-48961)

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an     attacker-controlled output glob.

    _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the     parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in     the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.

    Arbitrary Perl in the output glob executes at the calling process's privilege. (CVE-2026-48962)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in     fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the     chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting     a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a     per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.
    (CVE-2026-48959)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322099	Amazon Linux 2 : perl-IO-Compress, --advisory ALAS2-2026-3355 (ALAS-2026-3355)	Nessus	Amazon Linux Local Security Checks	high
322002	Amazon Linux 2023 : perl-IO-Compress, perl-IO-Compress-tests (ALAS2023-2026-1825)	Nessus	Amazon Linux Local Security Checks	high
317086	Linux Distros Unpatched Vulnerability : CVE-2026-48959	Nessus	Misc.	high

Detections

Analytics

CVE-2026-48959

high

Tenable Plugins

high

high

high