zip Rust Library: Denial of Service via ZIP64 Uncompressed Size (CVE-2026-115909)

The zip Rust library (versions 1.3.0 through 8.x) contains a vulnerability in ZipArchive::extract where the library trusts an attacker-controlled uncompressed size value from a ZIP64 archive. The library uses this value to initialize memory via Vec::with_capacity. If a malicious archive specifies an excessively large size, the application attempts an impossible memory allocation. Because this allocation path is infallible in Rust, the process is aborted immediately. This abort cannot be caught by catch_unwind or worker threads, enabling a persistent denial-of-service attack against any application that processes untrusted ZIP archives using this library.

Impact

The vulnerability results in a total denial-of-service for any process using the affected zip library to extract ZIP64 archives. The crash is non-recoverable, and the process is immediately terminated by the operating system, impacting the availability of the host application.

Recommendation

• Update the zip dependency to version 9.0.0 or later in all projects.
• Identify and audit applications that utilize the zip crate to process externally supplied or untrusted ZIP files.
• Implement strict input validation on the size of incoming ZIP archives before passing them to the ZipArchive::extract function.