Cloudanix VulnDB

CVE-2026-115909

High · 7.5

CVSS

7.5

EPSS

—

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a common Rust library used to open ZIP files lets an attacker send a specially made archive that crashes the program handling it, knocking services offline until they are restarted.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

ZipArchive::extract allocates a Vec using an attacker-supplied ZIP64 uncompressed_size value for symbolic-link targets before any entry validation occurs; an impossible capacity triggers an unrecoverable abort in the allocation path.

Why it matters to the business

Services or tools that extract untrusted ZIP archives can be forced offline repeatedly, causing outages and requiring manual restarts or restarts of worker processes.

How an attack unfolds

An attacker creates a minimal ZIP containing a symbolic-link entry whose ZIP64 uncompressed_size field is set to a value that exceeds available memory, then supplies the archive to any application using the vulnerable zip crate version; the extract call aborts the process before the entry can be rejected.

How to fix it

Upgrade the zip crate to version 9.0.0 or later; rebuild and redeploy all affected Rust binaries that depend on the library.

How to confirm the fix worked

Confirm the zip crate version is 9.0.0 or newer in Cargo.lock or equivalent manifest; test extraction of a crafted large-size symlink archive and verify the process no longer aborts.

Typical attack path

  1. Craft a small ZIP archive with a symlink entry whose ZIP64 uncompressed_size requests an impossible allocation
  2. Deliver the archive to an application that calls ZipArchive::extract on untrusted input
  3. Trigger the infallible Vec::with_capacity path, causing the process to abort
  4. Repeat the request to sustain denial of service

How to detect it

Monitor application and system logs for abrupt process terminations or allocation-failure aborts during ZIP extraction; correlate with inbound ZIP uploads or archive-processing jobs in the days after publication.

What your security team should do

  • Immediately update the zip dependency to 9.0.0 across all Rust projects and rebuild containers/images
  • Add the fixed version constraint to Cargo.toml files and enable automated dependency scanning
  • Review any services that accept user-supplied ZIP files and isolate extraction logic until patched

The record

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities