Cloudanix VulnDB

CVE-2026-115907

High · 7.5

CVSS

7.5

EPSS

—

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a Rust library for handling ZIP files lets attackers send specially crafted archives that crash programs trying to unpack them, knocking services offline.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Applications using the legacy-zip feature in the zip Rust crate (5.1.0 to 9.0.0) pre-allocate output buffers based on attacker-controlled ZIP64 uncompressed size fields before validating compressed data; this triggers capacity overflow panics in ShrinkDecoder (src/legacy/shrink.rs), ReduceDecoder, and ImplodeDecoder during ZipArchive::extract, resulting in unhandled termination.

Why it matters to the business

Archive-processing services or applications written in Rust can be crashed remotely, causing denial of service, disrupted workflows, and potential loss of availability for any system that extracts user-supplied or untrusted ZIP files.

How an attack unfolds

An attacker creates a ZIP64 archive containing an extremely large uncompressed size value, delivers it to a target service that uses the vulnerable zip crate with the legacy-zip feature enabled, and triggers ZipArchive::extract; the decoder attempts unbounded pre-allocation before stream validation, causing a panic that terminates the process.

How to fix it

Upgrade the zip crate to version 9.0.0 or later. If the legacy-zip feature cannot be removed, disable it and migrate to the modern API; test all archive-processing code paths after the update.

How to confirm the fix worked

Confirm the dependency version is 9.0.0 or newer via cargo tree or Cargo.lock; attempt extraction of a crafted large-ZIP64 test file in a controlled environment and verify absence of panic; monitor process stability under load.

Typical attack path

  1. Craft a malicious ZIP64 archive with an oversized uncompressed size field
  2. Deliver the archive to a Rust application or service that calls ZipArchive::extract under the legacy-zip feature
  3. Trigger extraction path that reaches ShrinkDecoder, ReduceDecoder, or ImplodeDecoder
  4. Induce capacity overflow panic to crash the service

How to detect it

Search application and system logs for panic messages containing capacity overflow, shrink decoder, or ZipArchive::extract failures; correlate with inbound ZIP file processing events; inspect Cargo.lock for vulnerable zip versions in deployed artifacts.

  • capacity overflow
  • ZipArchive::extract
  • shrink.rs
  • legacy/shrink
  • ReduceDecoder
  • ImplodeDecoder

What your security team should do

  • Immediately upgrade all Rust projects using zip < 9.0.0 with legacy-zip feature to version 9.0.0
  • Audit code for use of ZipArchive::extract on untrusted input and add panic handlers or sandboxing
  • Add runtime monitoring for archive-processing service restarts or panics
  • Review downstream dependents for transitive exposure given ecosystem prevalence of the crate

The record

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities