{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3azip_projectziprust/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zip_project:zip:*:*:*:*:*:rust:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-115909"},{"cvss":7.4,"id":"CVE-2026-115908"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["zip (\u003c 9.0.0)","zip (7.2.0 \u003c= version \u003c 9.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe zip Rust library (versions 1.3.0 through 8.x) contains a vulnerability in \u003ccode\u003eZipArchive::extract\u003c/code\u003e where the library trusts an attacker-controlled uncompressed size value from a ZIP64 archive. The library uses this value to initialize memory via \u003ccode\u003eVec::with_capacity\u003c/code\u003e. If a malicious archive specifies an excessively large size, the application attempts an impossible memory allocation. Because this allocation path is infallible in Rust, the process is aborted immediately. This abort cannot be caught by \u003ccode\u003ecatch_unwind\u003c/code\u003e or worker threads, enabling a persistent denial-of-service attack against any application that processes untrusted ZIP archives using this library.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a total denial-of-service for any process using the affected zip library to extract ZIP64 archives. The crash is non-recoverable, and the process is immediately terminated by the operating system, impacting the availability of the host application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the zip dependency to version 9.0.0 or later in all projects.\u003c/li\u003e\n\u003cli\u003eIdentify and audit applications that utilize the zip crate to process externally supplied or untrusted ZIP files.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on the size of incoming ZIP archives before passing them to the \u003ccode\u003eZipArchive::extract\u003c/code\u003e function.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T19:44:52Z","date_published":"2026-10-26T17:45:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zip-rust-dos-f3aab68b/","summary":"The zip Rust library is vulnerable to a denial-of-service condition where a malicious ZIP64 archive triggers an unrecoverable process abort through an impossible memory allocation request.","title":"zip Rust Library: Denial of Service via ZIP64 Uncompressed Size (CVE-2026-115909)","url":"https://feed.craftedsignal.io/briefs/2026-10-zip-rust-dos-f3aab68b/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:zip_project:zip:*:*:*:*:*:rust:*:*","version":"https://jsonfeed.org/version/1.1"}