CVE-2025-15649 Denial of service in IO::Uncompress::Unzip
An attacker can cause a denial of service by providing a zip file with a malformed DOS date, triggering an uncaught exception in the Perl library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-15649?
CVE-2025-15649 is a medium-severity denial of service vulnerability in PMQS IO::Uncompress::Unzip, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.
_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.
The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.
Weakness: CWE-248
Which versions are affected by CVE-2025-15649?
How do I fix CVE-2025-15649?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-15649 being exploited?
There is no known exploitation of CVE-2025-15649 in the wild and no public exploit code.
Sources
Also known as AZL-89283, BELL-CVE-2025-15649, DEBIAN-CVE-2025-15649, ECHO-6de8-d6d9-d48a, GHSA-hcq9-8v5x-mqjp, ROOT-OS-DEBIAN-11-CVE-2025-15649 and 1 more.