CVE-2026-92000: adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using adm-zip versions 0.5.14 through 0.6.0 are exposed when they decompress ZIP archives that an attacker can supply or influence. The impact is memory exhaustion and resulting denial of service.
What does an attacker need to exploit it?
An attacker needs to provide a crafted ZIP archive containing highly compressible entries that declare an uncompressed size of zero. No privileges or user interaction are required according to the supplied severity vector.
What can be done if updating is not immediately possible?
Avoid processing untrusted ZIP archives with affected adm-zip versions. Restrict archive upload or ingestion paths to trusted sources until the dependency can be updated.
How can I determine whether my deployment is affected?
Check the installed adm-zip version and review whether the application extracts or reads ZIP files from attacker-controlled or otherwise untrusted inputs. Versions from 0.5.14 through 0.6.0 that process such archives are affected.