Live › vulnerability › CVE-2026-115909
Go to dashboardThe zip Rust library, versions 1.3.0 through 8.x, calls Vec::with_capacity on a symbolic link target sized from an attacker-controlled ZIP64 uncompressed size before validating the entry. A small malicious archive makes the process abort, and catch_unwind cannot contain it, so an attacker can repeatedly crash archive-processing services.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Applications written in Rust that use the zip crate's ZipArchive::extract to process ZIP archives from untrusted sources, such as upload handlers or file ingestion services. Projects that only write ZIP files or only read archives they produce themselves are less exposed. Services that never extract user-supplied archives can skip it.
No product ranges from the sources yet.
cargo tree -i zip or by reading Cargo.lockzip versions from 1.3.0 up to but not including 9.0.0 in Cargo.lock9.0.0 or later with cargo update -p zipEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115909")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.