Vulnerabilities

TI-2026-36219 CVE-2026-48962 · GHSA-q6wx-vhvq-x7h6

IO::Compress versions before 2.220 for Perl can execute arbitrary code in…

LOW 38

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00439 Published 2026-05-27 Fixed in 2.220 CWE-95

TI-2026-36218 CVE-2026-48961 · GHSA-hjrw-gmwj-xc9c

Improper handling of exceptional conditions in PMQS IO::Compress

LOW 38

IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00262 Published 2026-05-27 Partial fix · 2.220 CWE-755

TI-2026-36217 CVE-2026-48959 · GHSA-7vxx-5gqr-7r44

IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte…

MEDIUM 40

IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00553 Published 2026-05-27 Partial fix · 2.220 CWE-407

TI-2025-14272 CVE-2025-15649 · GHSA-hcq9-8v5x-mqjp

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when…

LOW 24

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00127 Published 2026-05-27 Partial fix · 2.215 CWE-248

TI-2026-02917 CVE-2026-3381 · GHSA-jvq4-fjjq-g6w7

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of…

MEDIUM 50

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00622 Published 2026-03-05 No fix listed CWE-1395