CVE-2026-115907: zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zipto a version that resolves this vulnerability.Fixed in 9.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Applications using the Rust zip crate from 5.1.0 up to, but not including, 9.0.0 are affected when they are built with the legacy-zip feature and process attacker-controlled ZIP archives through the legacy Shrink, Reduce, or Implode decoder paths.
What does an attacker need to do to trigger the issue?
An attacker needs to provide a crafted ZIP64 archive with an attacker-controlled uncompressed-size value. No authentication or user interaction is required according to the provided vector.
What is the operational impact if exploitation succeeds?
The decoder can panic due to a capacity overflow during ZipArchive::extract. If the panic is unhandled, it can terminate the archive-processing service.
What version resolves the issue?
The issue is fixed in zip version 9.0.0.