Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Corregido en 9.0.0 (la última es 9.1.3), que también arregla dos DoS de severidad alta: CVE-2026-115907 y CVE-2026-115909. Corre cargo tree -i zip para ver si lo traes por otra dependencia. Advisory: https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv ¿Extraes ZIPs de usuarios en producción?