ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-115907

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

Published Oct 29, 2026 · catalog updated Oct 29, 2026 · zip: legacy Shrink/Reduce/Implode decoder:

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115907. EPSS is 0.35%. Act only if a listed version of zip: legacy Shrink/Reduce/Implode decoder: is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (zip: legacy Shrink/Reduce/Implode decoder:).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.35%
Remediation
Version ranges on file
Affected products
cargo zip · rust zip

### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable and use . An attacker-controlled ZIP64 uncompressed size triggers a panic in the Shrink decoder in optimized builds, potentially terminating the affected process. ### Details When reading a Shrink-compressed entry, buffers the compressed input and reserves output capacity using the entry's declared uncompressed size: In version 8.6.0, this is located in [ ](https://github.com/zip-rs/zip2/blob/771dfc534d2614158af5497ea3dff4d4208d7db1/src/legacy/shrink.rs#L341-L352). The vulnerable legacy codecs are compiled when the Cargo feature is enabled. is populated from ZIP metadata. For ZIP64 entries, an attacker can set it to a 64-bit value independently of the archive's actual compressed payload size. The PoC declares an uncompressed size of , while supplying only one byte of compressed data. The reserve occurs before can validate or decode the compressed stream. Consequently, the impossible capacity causes a deterministic panic instead of returning a normal archive or I/O error. The behavior also occurs in optimized release builds and is reachable through . The same unbounded allocation pattern is present in the legacy Reduce and Implode decoder implementations. This PoC specifically demonstrates the Shrink path. ### PoC Create a new Cargo project with the following layout: Use this : Use this : Run the reproducer in release mode: Observed output with 8.6.0 on : The backtrace reaches the Shrink decompressor through and . The process exits with status 101. The program also writes the generated 149-byte archive to before triggering extraction. ### Impact Applications that enable and pass attacker-supplied ZIP files to the following extraction API can be forced to panic before the compressed entry is validated or decoded. An unhandled panic may terminate the archive-processing process and cause a denial of service. -

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cargo zip>=5.1.0 <9.0.0
  • rust zip>= 5.1.0, < 9.0.0

How to fix CVE-2026-115907

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115907. EPSS is 0.35%. Act only if a listed version of zip: legacy Shrink/Reduce/Implode decoder: is installed.

Which versions are affected?

Compare what you have installed with >=5.1.0 <9.0.0, >= 5.1.0, < 9.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-789. EPSS 0.35%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 29, 2026 · GitHub Advisory Database

    Detected

    ### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable and use . An attacker-controlled ZIP64 uncompressed size triggers a panic in the Shrink decoder in optimized builds, potentially terminating the affected process. ### Details When reading a Shrink-compressed entry, buffers the compressed input and reserves output capacity using the entry's declar

  2. Oct 29, 2026 · GitHub Advisory Database

    Updated

    ### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable and use . An attacker-controlled ZIP64 uncompressed size triggers a panic in the Shrink decoder in optimized builds, potentially terminating the affected process. ### Details When reading a Shrink-compressed entry, buffers the compressed input and reserves output capacity using the entry's declar

Sources

  • CVE.orgVulnerability recordCVE-2026-115907

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-9hj8-73fh-9963

    zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-115907

    A malicious 149-byte ZIP archive can cause a denial of service in applications that enable legacy-zip and use ZipArchive::extract(). An attacker-controlled ZIP64 uncompressed size triggers a capacity overflow panic in the Shrink decoder in optimized builds, potentially terminating the affected process.

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorycargo/zip/CVE-2026-115907.yml

    A malicious 149-byte ZIP archive can cause a denial of service in applications + that enable and use . An attacker-controlled + ZIP64 uncompressed size triggers a panic in the Shrink decoder + in optimized builds, potentially terminating the affected process." +date: "2026-10-29" +pubdate: "2026-10-29" +affected_range: ">=5.1.0 <9.0.0" +fixed_versions: +- "9.0.0" +affected_versions: "All versions

    gitlab.com

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • CVE.orgOct 30, 2026
  • GitLab Advisory DatabaseOct 30, 2026
  • GitLab Advisory DatabaseOct 30, 2026
  • GitHub Advisory DatabaseOct 30, 2026