CVE-2026-115906

Name of the Vulnerable Software and Affected Versions zip versions 0.6.0 through 8.9.9

Description The AES entry reader in src/aes.rs verifies its HMAC (Hash-based Message Authentication Code, a mechanism for verifying both the data integrity and the authenticity of a message) only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the end of the archive while data remaining is still positive, or if an encrypted entry has no payload, the reader may return a clean end of stream without comparing the authentication tag. Consequently, applications using the functions by index decrypt(), by name decrypt(), by path decrypt(), or password-enabled by index with options() may accept modified plaintext without triggering an authentication error.

Recommendations Update to version 9.0.0.