RUSTSEC-2025-0172 `zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead
- Exploited in the wild
- Not known
- Fix
- None listed
What is RUSTSEC-2025-0172?
RUSTSEC-2025-0172 is a vulnerability in zip-extract, published on 16 Jul 2025.
Official description
The zip-extract crate has been
explicitly deprecated by its author on Jul 16, 2025, and the repository
was archived on Sep 8, 2025.
The author added deprecation notices README
stating that the functionality is now available directly in the zip crate
via ZipArchive::extract
(available since zip 0.6.0) and
ZipArchive::extract_unwrapped_root_dir
(available since zip 2.4.0).
If you are using zip-extract, switch to the
zip >= 2.4.0 crate and use the methods above instead.
Which versions are affected by RUSTSEC-2025-0172?
1 open source package ship an affected version, including zip-extract.
| Package | Affected | Fixed in |
|---|---|---|
zip-extract crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2025-0172?
No fix has been published for RUSTSEC-2025-0172 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2025-0172 being exploited?
There is no known exploitation of RUSTSEC-2025-0172 in the wild and no public exploit code.