CVE-2025-15649Disclosure

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-248

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets2 URLs

By indicator

Full discourse1 post

Open Source Security mailing list@oss_security137d
Disclosure
CVE-2025-15649: IO::Uncompress::Unzip before 2.215 propagate uncaught exception when parsing zip header with malformed DOS date https://www.openwall.com/lists/oss-security/2026/05/27/1 CVE-2026-48959: IO::Uncompress::Unzip before 2.220 CPU exhaustion via per-byte read loop in fastForward https://www.openwall.com/lists/oss-security/2026/05/27/2
Post summary
The Openwall mailing list posts announce two new CVEs in IO::Uncompress::Unzip, describing the nature of the vulnerabilities but providing no patches, exploit code, or evidence of active exploitation.
10020398
4.7K followersView on X

Explore more

Back to dashboard