---
id: "CVE-2026-115906"
kind: "vulnerability"
aliases: ["CVE-2026-115906"]
title: "zip Rust crate: truncated AES entries can skip HMAC authentication check"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cargo", "package", "rust", "zip"]
not_affected_if: ["no-aes-decryption", "trusted-archives-only"]
published_at: "2026-10-26T17:17:17+00:00"
first_seen_at: "2026-10-26T17:31:22+00:00"
updated_at: "2026-10-26T17:33:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115906", "first_seen_at": "2026-10-26T17:31:22+00:00"}]
---

# zip Rust crate: truncated AES entries can skip HMAC authentication check

The zip Rust crate, versions 0.6.0 through 8.x, can return a clean end of stream for an AES-encrypted entry without verifying its authentication tag when the archive is truncated or the entry has no payload. An attacker who can modify an encrypted archive can get tampered plaintext accepted without an authentication error.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the zip version in Cargo.lock with `grep -A1 'name = "zip"' Cargo.lock`
- Look for calls to `by_index_decrypt`, `by_name_decrypt`, `by_path_decrypt` or `by_index_with_options` with a password in the project source

## Fix

- Upgrade the zip crate to `9.0.0` or later with `cargo update -p zip`
- Until upgraded, do not rely on AES-encrypted zip entries from untrusted sources for integrity

## Timeline

- 2026-10-26T17:31:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115906

## From the sources

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_