IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-fb1f15ce04 advisory.

    perl-Compress-Taw-Bzip2 - Updated to 2.218     perl-IO-Compress - Updated to 2.221 - Fix CVE-2025-15649, CVE-2026-48959, CVE-2026-48961, CVE-2026-48962


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21177-1 advisory.

    Changes in perl-IO-Compress:

    - updated to 2.220.0 (2.220)        see /usr/share/doc/packages/perl-IO-Compress/Changes

        2.220 16 May 2026
          * remove use of eval in globmapper. #73             CVE-2026-48962 bsc#1266382
          * Update zipdetails to version 4.006.
            CVE-2026-48961 bsc#1266381
          * Fix typo in fastForward #72
          * Fix issue with rawdeflate` option in AnyInflate. #71

    - updated to 2.219.0 (2.219)        see /usr/share/doc/packages/perl-IO-Compress/Changes

        2.219 9 March 2026
          * Fix a few  typos
          * Squash repeated semicolons
          * Make dependent version checking consistent amd update module to version 2.219. Fixes #70         2.218 8 March 2026
          * Refresh zipdetails to version 4.005 Sourced from https://github.com/pmqs/zipdetails
          * version 2.218
          * Add SECURITY.md,  Fixes #69
          * fix spelling typo
          * Refresh Changes file
          * Update release date in README
          * Refresh zipdetails from https://github.com/pmqs/zipdetails         2.217 1 February 2026
          * Update release date in README
          * Refresh zipdetails from https://github.com/pmqs/zipdetails
          * Delete GZIP environment variable before running interop tests Fixes #24
          * Update version to 2.217         2.216 31 January 2026
            * Update version to 2.216
            * IO::Compress @2.215: t/006zip.t fails due to missing test files #67         2.215 31 January 2026
            * Fix version check in 000prereq.t
            * Update Changes for 2.215
            * Update version to 2.215 & change copyright year to 2026
            * Add tests for handling zero and invalid datetime values in unzip functionality. Fix for #65
            * Enhance _dosToUnixTime to handle zero and invalid datetime values; add tests for edge cases.
    Fixes #65

    - updated to 2.214.0 (2.214)        see /usr/share/doc/packages/perl-IO-Compress/Changes

        2.214 24 October 2025
            * version 2.214
            * IO::Compress::Gzip accidentally modifies the `$EXPORT_TAGS{all}->@*` of other modules Fixes #64
            * Fix indentation in Windows workflow YAML
            * Fix indentation in windows.yml exclude section
            * Merge pull request #63 from masiuchi/fix/ci-errors
            * Exclude Perl 5.42 with strawberry distribution from GitHub Actions
            * Update FreeBSD image to 14.3 in Cirrus CI
            * Add dependabot.yml file to police workflow files
            * Add perl 5.42 to workflow files
            * Fix for https://github.com/pmqs/Compress-Raw-Zlib/issues/34
            * #59 fix typos in streamzip

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7ecfdcf0e3 advisory.

    perl-Compress-Taw-Bzip2 - Updated to 2.218     perl-IO-Compress - Updated to 2.221 - Fix CVE-2025-15649, CVE-2026-48959, CVE-2026-48961, CVE-2026-48962


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1825 advisory.

    IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in     fastForward.

    fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c     instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.

    Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name =>     $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB     cap. (CVE-2026-48959)

    IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with     undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.

    When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID     Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through     decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same     file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and     the script exits with status 255.

    Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI     tool. (CVE-2026-48961)

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an     attacker-controlled output glob.

    _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the     parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in     the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.

    Arbitrary Perl in the output glob executes at the calling process's privilege. (CVE-2026-48962)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with     undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in     bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8,     causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which     calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with     underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status     255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI     tool. (CVE-2026-48961)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325616	Fedora 43 : perl-Compress-Raw-Bzip2 / perl-IO-Compress (2026-fb1f15ce04)	Nessus	Fedora Local Security Checks	high
324886	openSUSE 16 Security Update : perl-IO-Compress (openSUSE-SU-2026:21177-1)	Nessus	SuSE Local Security Checks	high
322855	Fedora 44 : perl-Compress-Raw-Bzip2 / perl-IO-Compress (2026-7ecfdcf0e3)	Nessus	Fedora Local Security Checks	high
322002	Amazon Linux 2023 : perl-IO-Compress, perl-IO-Compress-tests (ALAS2023-2026-1825)	Nessus	Amazon Linux Local Security Checks	high
317091	Linux Distros Unpatched Vulnerability : CVE-2026-48961	Nessus	Misc.	high

Detections

Analytics

CVE-2026-48961

high

Tenable Plugins

high

high

high

high

high