CVE-2026-115909
Received Received - Intake

ZipArchive::extract Denial of Service in zip Rust library

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115909
EUVD
EUVD-2026-109987

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zip-rs zip2 >= 1.3.0, < 9.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the zip library for Rust, specifically versions 1.3.0 to 9.0.0. The issue is in the ZipArchive::extract function which uses Vec::with_capacity to allocate memory for a symbolic link target based on an attacker-controlled ZIP64 uncompressed_size value. This can lead to an impossible memory allocation request, causing the program to abort before validating the entry.

Detection Guidance

This vulnerability can be detected by checking the version of the zip library in use. If your application uses the Rust zip library and the version is between 1.3.0 and 9.0.0, it is vulnerable. Run commands like 'cargo tree -p zip' or 'grep -r "zip =" Cargo.lock' to check the version.

Impact Analysis

This vulnerability can cause denial of service in applications processing ZIP archives. An attacker could create a small malicious archive that triggers an abort in the program, repeatedly crashing it. This affects any software using the vulnerable zip library versions to handle ZIP files.

Mitigation Strategies

Immediately update the zip library to version 9.0.0 or later. If updating is not possible, consider removing or replacing the library in applications that process untrusted ZIP archives. Monitor for crashes in archive-processing applications as a potential sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115909. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart