PT-2026-93178 · Npm · Adm-Zip
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
adm-zip versions 0.5.14 through 0.6.0
Description
The software fails to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. This allows attackers to use malicious ZIP archives containing highly compressible entries that declare zero size to exhaust system memory, resulting in a denial of service.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Adm-Zip