CVE-2026-115907

Name of the Vulnerable Software and Affected Versions zip versions 5.1.0 through 8.x.x

Description Applications using the legacy-zip feature may reserve output capacity based on an attacker-controlled ZIP64 uncompressed size before the compressed stream is validated. This unbounded preallocation pattern exists in the ShrinkDecoder path within src/legacy/shrink.rs, as well as in the Reduce and Implode decoders. Consequently, the ZipArchive::extract() function can trigger a capacity overflow panic, which may lead to the termination of an archive-processing service.

Recommendations Update to version 9.0.0.