ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-115909

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

Published Oct 22, 2026 · catalog updated Oct 29, 2026 · RustSec Rust

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115909. EPSS is 0.46%. Act only if a listed version of RustSec Rust is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.46%
Remediation
Version ranges on file
Affected products
cargo zip · rust zip

### Summary The symbolic-link branch of allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with through this infallible allocation. ### Details [ ](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/mod.rs#L399-L405) (reviewed commit ); the same code is at [ ](https://github.com/zip-rs/zip2/blob/v8.6.0/src/read.rs#L417-L418) in released v8.6.0. Both inputs are attacker-controlled: - [ ](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/zipfile.rs#L243-L246) returns verbatim from the central directory record. A ZIP64 extended-information extra field widens it to a full ([ ](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/mod.rs#L619-L625)). It is never cross-checked against the compressed size, the remaining archive length, or any platform-appropriate bound for a symlink target. - [ ](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/zipfile.rs#L256-L260) is decided entirely by the central directory's external-attributes field, via the bit. **Memory allocation failure → uncatchable process abort.** The reservation is sized from the declared before a single byte of the entry is read. is infallible: on allocator refusal it calls , which aborts the process. This is not a Rust panic — it is not caught by , is unaffected by , and is not contained by isolating the call in a worker thread. This was verified by wrapping the call in all three at once; the process still died with exit 134. The declared value needed is a property of the host's address space, not of reachability. On a 64 GB host with heuristic overcommit, declared sizes from roughly upward abort reliably. Sizes at or above instead trip 's internal capacity check and produce a *catchable* panic, so an attacker simply avoids that band. The reproducer declares , which exceeds the 47-bit use

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cargo zipversion unspecified
  • rust zip>= 1.3.0, < 9.0.0

How to fix CVE-2026-115909

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115909. EPSS is 0.46%. Act only if a listed version of RustSec Rust is installed.

Which versions are affected?

Compare what you have installed with >= 1.3.0, < 9.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-789. EPSS 0.46%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 29, 2026 · GitHub Advisory Database

    Detected

    ### Summary The symbolic-link branch of allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with through this infallible allocation. ### Details [ ](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/mod.rs#L399-L405) (reviewed commit ); the same code is at [ ](https://github.com/z

  2. Oct 29, 2026 · GitHub Advisory Database

    Updated

    ### Summary The symbolic-link branch of allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with through this infallible allocation. ### Details [ ](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/mod.rs#L399-L405) (reviewed commit ); the same code is at [ ](https://github.com/z

Sources

  • CVE.orgVulnerability recordCVE-2026-115909

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-q7v9-x93c-xqv3

    zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-115909

    The symbolic-link branch of ZipArchive::extract_internal() allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with SIGABRT through this infallible allocation.

    advisories.gitlab.com
  • RustSec Advisory DBVendor advisoryCVE-2026-115909

    sizes the symlink-target buffer from the uncompressed size declared in the central directory record, before reading a single byte of entry data: Both inputs are attacker-controlled. returns verbatim from the central directory, widened to a full by a ZIP64 extended-information ext

    crates.io

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • RustSec Advisory DBNov 6, 2026
  • CVE.orgOct 30, 2026
  • GitLab Advisory DatabaseOct 30, 2026
  • GitHub Advisory DatabaseOct 30, 2026