CVE-2026-115909

Name of the Vulnerable Software and Affected Versions zip versions 1.3.0 through 8.9.9

Description In the ZipArchive::extract() function within src/read/mod.rs, the library uses the Vec::with capacity method for symbolic link targets based on the uncompressed size variable from ZIP64 headers. Because this value is attacker-controlled and processed before entry validation, a specially crafted small archive can request an impossible memory capacity. This triggers an infallible allocation path that aborts the process, leading to a denial of service. This failure cannot be mitigated using catch unwind or worker threads.

Recommendations Update to version 9.0.0.