{"id":"CVE-2026-115907","kind":"vulnerability","aliases":["CVE-2026-115907"],"related":[],"title":"zip (Rust): crafted ZIP64 size makes extraction panic and crash","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.","summary":"The zip Rust crate, when built with the legacy-zip feature, reserves output memory from an attacker-supplied ZIP64 uncompressed size before checking the compressed data. A crafted archive makes ZipArchive::extract panic with a capacity overflow, which can terminate a service that processes archives.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cargo","package","rust","zip"],"not_affected_if":["legacy-zip-disabled","trusted-archives-only"],"how_to_check":"- Check whether the project depends on `zip` in Cargo.toml or Cargo.lock and note the version, for example `cargo tree -i zip`.\n- Check whether the `legacy-zip` feature is enabled on the `zip` dependency.\n- Check whether the application calls `ZipArchive::extract` on archives from untrusted sources.","fix":"- Upgrade the `zip` crate to `9.0.0` or later.\n- Rebuild and redeploy services that extract untrusted archives.","status":"open","published_at":"2026-10-26T17:17:18+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:07+00:00","updated_at":"2026-10-26T17:33:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T17:33:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `zip` crate to `9.0.0` or later.\n- Rebuild and redeploy services that extract untrusted archives.","reach":"internet","title":"zip (Rust): crafted ZIP64 size makes extraction panic and crash","impact":"medium","summary":"The zip Rust crate, when built with the legacy-zip feature, reserves output memory from an attacker-supplied ZIP64 uncompressed size before checking the compressed data. A crafted archive makes ZipArchive::extract panic with a capacity overflow, which can terminate a service that processes archives.","category":"package","nicknames":[],"who_cares":["rust","zip","cargo"],"confidence":0.7,"needs_auth":"no","worst_case":"Crafted archive crashes the archive-processing service via unhandled panic","analyst_note":"","how_to_check":"- Check whether the project depends on `zip` in Cargo.toml or Cargo.lock and note the version, for example `cargo tree -i zip`.\n- Check whether the `legacy-zip` feature is enabled on the `zip` dependency.\n- Check whether the application calls `ZipArchive::extract` on archives from untrusted sources.","needs_analyst":false,"not_affected_if":["legacy-zip-disabled","trusted-archives-only"],"who_is_affected":"Applications built with the zip crate from `5.1.0` through `9.0.0` that enable the legacy-zip feature and extract ZIP files supplied from outside. Applications that do not enable legacy-zip, or that only read trusted archives, are less exposed. The sources do not say whether default feature sets include legacy-zip.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":3410,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115907':13A,16A '-2026':12A,15A '5.1.0':84C '9.0.0':86C,154C 'applic':87C 'archiv':51B,67B,145C 'archive-process':144C 'attack':39B,102C 'attacker-control':101C 'attacker-suppli':38B 'built':26B,88C 'capac':58B,98C,121C 'cargo':17B 'check':45B 'compress':47B,110C 'contain':132C 'control':103C 'craft':3A,50B 'crash':10A 'crate':24B 'cve':11A,14A 'data':48B 'decod':131C 'extract':7A,54B,125C 'featur':32B,94C 'file':82C 'fix':151C 'implod':130C 'issu':149C 'legaci':30B,92C 'legacy-zip':29B,91C 'librari':72C 'make':6A,52B 'memori':35B 'output':34B,97C 'overflow':59B,122C 'packag':18B 'panic':8A,55B,118C,140C 'path':114C 'pattern':137C 'prealloc':136C 'process':66B,146C 'read':77C 'reduc':128C 'reserv':33B,96C 'rust':2A,19B,23B,74C 'servic':64B,147C 'shrinkdecod':113C 'simpl':80C 'size':5A,43B,106C 'src/legacy/shrink.rs':116C 'stream':111C 'suppli':40B 'support':76C 'termin':62B,142C 'unbound':135C 'uncompress':42B,105C 'unhandl':139C 'valid':108C 'version':153C 'write':79C 'zip':1A,20B,22B,31B,68C,71C,81C,93C 'zip64':4A,41B,104C 'ziparch':53B,124C","nicknames":[],"mitigations":[],"who_affected":"Applications built with the zip crate from `5.1.0` through `9.0.0` that enable the legacy-zip feature and extract ZIP files supplied from outside. Applications that do not enable legacy-zip, or that only read trusted archives, are less exposed. The sources do not say whether default feature sets include legacy-zip.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115907","severity":null,"published_at":"2026-10-26T17:17:18+00:00","modified_at":"2026-10-26T17:17:18+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}