Live › vulnerability › CVE-2026-115907
Go to dashboardThe zip Rust crate, when built with the legacy-zip feature, reserves output memory from an attacker-supplied ZIP64 uncompressed size before checking the compressed data. A crafted archive makes ZipArchive::extract panic with a capacity overflow, which can terminate a service that processes archives.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Applications built with the zip crate from through that enable the legacy-zip feature and extract ZIP files supplied from outside. Applications that do not enable legacy-zip, or that only read trusted archives, are less exposed. The sources do not say whether default feature sets include legacy-zip.
5.1.09.0.0No product ranges from the sources yet.
zip in Cargo.toml or Cargo.lock and note the version, for example cargo tree -i zip.legacy-zip feature is enabled on the zip dependency.ZipArchive::extract on archives from untrusted sources.zip crate to 9.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115907")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.