Cpe:2.3:a:zip-Rs:zip:*:*:*:*:*:rust:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3azip-rsziprust/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 17:45:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgzip-rs: Denial of service via unchecked ZIP64 allocation (CVE-2026-115907)https://feed.craftedsignal.io/briefs/2026-10-zip-rust-dos/Mon, 26 Oct 2026 17:45:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zip-rust-dos/The Rust zip library is vulnerable to a denial-of-service condition where attacker-controlled ZIP64 uncompressed size headers trigger memory allocation panics during extraction, causing service termination.The zip-rs library, specifically when the 'legacy-zip' feature is enabled, contains a vulnerability that allows an attacker to trigger an unhandled panic by supplying a maliciously crafted ZIP archive. The library preallocates output memory based on the ZIP64 uncompressed size field before validating the integrity of the compressed data. This vulnerability affects the Shrink, Reduce, and Implode decoders within the library. If an archive-processing service attempts to extract such a file, the resulting capacity overflow leads to a panic and subsequent termination of the service. This issue is resolved in version 9.0.0.

Impact

Successful exploitation results in a denial-of-service condition for the application or service consuming the library, as the unhandled panic terminates the processing thread or the entire service process.

Recommendation

  • Update the zip-rs crate to version 9.0.0 or later to ensure the library properly validates compressed stream data before allocating output capacity.
  • Audit applications using the 'legacy-zip' feature to determine if they are exposed to untrusted user-supplied ZIP files.
  • Implement memory limits or resource constraints on containerized or service-level environments that process uploaded archives to mitigate the impact of unexpected allocation attempts.
]]>lowadvisory