CVE-2026-115907 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115907?
CVE-2026-115907 is a high-severity vulnerability in zip-rs zip2, published on 26 Oct 2026.
Official description
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.
Which versions are affected by CVE-2026-115907?
2 open source packages ship an affected version, including zip.
| Package | Affected | Fixed in |
|---|---|---|
zip crates.io | From 5.1.0 | 9.0.0 |
zip crates.io | From 5.1.0 | 9.0.0 |
How do I fix CVE-2026-115907?
Upgrade zip to 9.0.0 or later.
Is CVE-2026-115907 being exploited?
There is no known exploitation of CVE-2026-115907 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115907, GHSA-9hj8-73fh-9963, UBUNTU-CVE-2026-115907.