[Git][security-tracker-team/security-tracker][master] CVE-2026-48961/perl - bookworm is not affected

[Arnaud Rebillout (@arnaudr)]

Arnaud Rebillout pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8db84ea4 by Arnaud Rebillout at 2026-09-30T09:05:38+07:00
CVE-2026-48961/perl - bookworm is not affected

The issue was introduced in IO::Compress v2.207. In bookworm, we have
Perl 5.36 and it embeds IO::Compress 2.106.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -132214,6 +132214,7 @@ CVE-2026-48961 (IO::Compress versions from 2.207 before 2.220 for Perl ship a zi
 	[bullseye] - libio-compress-perl <not-affected> (Vulnerable code introduced later)
 	- perl 5.40.1-8 (bug #1138855)
 	[trixie] - perl 5.40.1-6+deb13u1
+	[bookworm] - perl <not-affected> (Vulnerable code introduced later)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/40434383/
 	NOTE: Introduced with: https://github.com/pmqs/IO-Compress/commit/ddfe67584a228877e5d28840da75ff32e435a5e3 (v2.207)
 	NOTE: Fixed by: https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7 (v2.220)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8db84ea45b6ed8d5f61eccc78b86db7933861bba

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8db84ea45b6ed8d5f61eccc78b86db7933861bba
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/2a3f2d25/attachment.htm>