https://feed.craftedsignal.io/products/zip--9.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 17:45:50 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-zip-rust-dos-f3aab68b/Mon, 26 Oct 2026 17:45:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zip-rust-dos-f3aab68b/The zip Rust library is vulnerable to a denial-of-service condition where a malicious ZIP64 archive triggers an unrecoverable process abort through an impossible memory allocation request.The zip Rust library (versions 1.3.0 through 8.x) contains a vulnerability in ZipArchive::extract where the library trusts an attacker-controlled uncompressed size value from a ZIP64 archive. The library uses this value to initialize memory via Vec::with_capacity. If a malicious archive specifies an excessively large size, the application attempts an impossible memory allocation. Because this allocation path is infallible in Rust, the process is aborted immediately. This abort cannot be caught by catch_unwind or worker threads, enabling a persistent denial-of-service attack against any application that processes untrusted ZIP archives using this library.

Impact

The vulnerability results in a total denial-of-service for any process using the affected zip library to extract ZIP64 archives. The crash is non-recoverable, and the process is immediately terminated by the operating system, impacting the availability of the host application.

Recommendation

• Update the zip dependency to version 9.0.0 or later in all projects.
• Identify and audit applications that utilize the zip crate to process externally supplied or untrusted ZIP files.
• Implement strict input validation on the size of incoming ZIP archives before passing them to the ZipArchive::extract function.

]]>highadvisoryhttps://feed.craftedsignal.io/briefs/2026-10-zip-rust-dos/Mon, 26 Oct 2026 17:45:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zip-rust-dos/The Rust zip library is vulnerable to a denial-of-service condition where attacker-controlled ZIP64 uncompressed size headers trigger memory allocation panics during extraction, causing service termination.The zip-rs library, specifically when the 'legacy-zip' feature is enabled, contains a vulnerability that allows an attacker to trigger an unhandled panic by supplying a maliciously crafted ZIP archive. The library preallocates output memory based on the ZIP64 uncompressed size field before validating the integrity of the compressed data. This vulnerability affects the Shrink, Reduce, and Implode decoders within the library. If an archive-processing service attempts to extract such a file, the resulting capacity overflow leads to a panic and subsequent termination of the service. This issue is resolved in version 9.0.0.

Impact

Successful exploitation results in a denial-of-service condition for the application or service consuming the library, as the unhandled panic terminates the processing thread or the entire service process.

Recommendation

• Update the zip-rs crate to version 9.0.0 or later to ensure the library properly validates compressed stream data before allocating output capacity.
• Audit applications using the 'legacy-zip' feature to determine if they are exposed to untrusted user-supplied ZIP files.
• Implement memory limits or resource constraints on containerized or service-level environments that process uploaded archives to mitigate the impact of unexpected allocation attempts.

]]>lowadvisory