CVE-2026-115909: zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catchunwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zipto a version that resolves this vulnerability.Fixed in 9.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Applications that use the Rust zip crate's ZipArchive::extract on attacker-controlled or otherwise untrusted ZIP archives are exposed. A maliciously small archive can declare a very large ZIP64 uncompressed size for a symbolic-link target and abort the extracting process.
Does exploitation require authentication, user interaction, or a valid large archive?
No privileges or user interaction are required according to the provided vector. The attacker can use a small crafted archive; the declared size controls the allocation before the entry data is validated.
Can an application contain the failure with catch_unwind or by extracting in a worker thread?
No. The allocation uses an infallible path that can abort the process, and the description states that this cannot be contained by catch_unwind or a worker thread.
What remediation is available?
Upgrade the zip crate to version 9.0.0, which fixes the issue. The affected versions are from 1.3.0 until 9.0.0.