The vulnerability in IO::Uncompress::Unzip (prior to version 2.220) arises from the fastForward() function's logic error where it compares the length of the offset's digit count instead of the offset value itself against the chunk size. This causes the chunk size to reduce from 16 KiB to between 1 and 19 bytes per iteration, leading to a per-byte read loop when extracting a targeted zip entry. An attacker supplying a malicious zip file can exploit this to cause CPU exhaustion during decompression, resulting in a denial of service condition. The issue is classified under CWE-407 (Inefficient Algorithmic Complexity).

The vulnerability allows an unauthenticated attacker to cause high CPU usage on systems using vulnerable versions of IO::Uncompress::Unzip by supplying a specially crafted zip file. This leads to denial of service due to CPU exhaustion during decompression. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor or CPAN security advisories for updates and apply any official patches once released. Until then, avoid processing untrusted zip files with vulnerable versions of IO::Uncompress::Unzip or implement external controls to limit resource consumption during decompression.