CVE-2026-115906: zip: AES Entry HMAC Authentication Bypass on Premature EOF
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while dataremaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using byindexdecrypt, bynamedecrypt, bypathdecrypt, or password-enabled byindexwithoptions can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zipto a version that resolves this vulnerability.Fixed in 9.0.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the Rust zip crate from version 0.6.0 up to, but not including, 9.0.0 are affected when they decrypt AES-encrypted entries through by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options.
What must an attacker do to exploit the flaw?
An attacker must provide a crafted AES-encrypted ZIP entry that causes the bounded reader to reach the actual end of the archive while the entry's attacker-controlled remaining-data counter is still positive, or an encrypted entry with no payload. This can allow modified plaintext to be accepted without an authentication error.
Is user interaction required?
Yes. The supplied vector indicates user interaction is required. The affected application must be induced to process the malicious ZIP archive.
How can this be remediated?
Upgrade the zip crate to version 9.0.0, which fixes the missing HMAC verification condition.