{"id":"EUVD-2026-109983","enisaUuid":"6b604de2-7d5a-3986-8474-40f70285f9ca","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:30:30 PM","dateUpdated":"Oct 31, 2026, 1:32:55 AM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4\nhttps://github.com/zip-rs/zip2/commit/ec265db0b0602f8ffb9479327397bddefb7e2216\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","aliases":"CVE-2026-115906\nGHSA-8hxf-qr8p-62x4\n","assigner":"GitHub_M","epss":0.15,"enisaIdProduct":[{"id":"a08b8325-23bb-38e7-a462-981ab5dcca4d","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"0.6.0, \u003c 9.0.0"}],"enisaIdVendor":[{"id":"5eba151a-2a6d-39e3-8d42-c5675aa02a25","vendor":{"name":"zip-rs"}}],"enisaIdVulnerability":[{"id":"9ba5221f-013e-31fb-abd6-127c3fe5200c","vulnerability":{"id":"CVE-2026-115906","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:30:30 PM","dateUpdated":"Oct 31, 2026, 1:32:55 AM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4\nhttps://github.com/zip-rs/zip2/commit/ec265db0b0602f8ffb9479327397bddefb7e2216\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109983\n","assigner":"GitHub_M","epss":0.15,"dataProcessed":"Nov 2, 2026, 9:00:42 PM","vulnerabilityProduct":[{"id":"980eaa8e-111c-3254-b302-01773d18ad8c","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"0.6.0, \u003c 9.0.0"}],"vulnerabilityVendor":[{"id":"331af110-177e-323a-a6dd-2767f6c9ee1e","vendor":{"name":"zip-rs"}}]}},{"id":"a0590a82-55da-3dca-94f5-675b473472ff","vulnerability":{"id":"GHSA-8hxf-qr8p-62x4","description":"zip: AES Entry HMAC Authentication Bypass on Premature EOF","datePublished":"Oct 29, 2026, 4:40:07 PM","dateUpdated":"Oct 29, 2026, 4:40:07 PM","baseScore":0.0,"references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115906\nhttps://github.com/zip-rs/zip2/commit/ec265db0b0602f8ffb9479327397bddefb7e2216\nhttps://github.com/zip-rs/zip2\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109983\n","aliases":"GHSA-8hxf-qr8p-62x4\nCVE-2026-115906\n","epss":0.0,"dataProcessed":"Nov 2, 2026, 7:03:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"a58cbffa-52ea-3f5e-84ae-3ba737e2966f","advisory":{"id":"msrc_CVE-2026-115906","description":"zip: AES Entry HMAC Authentication Bypass on Premature EOF","datePublished":"Oct 31, 2026, 1:14:30 AM","dateUpdated":"Oct 31, 2026, 1:14:30 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-115906.json\n","aliases":"CVE-2026-115906\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"a6789ef4-bd68-3ba1-8f31-b9c6b1c14693","product":{"name":"azl3 rust 0:1.96.1-2.azl3","vendor":{"name":"Microsoft"}}},{"id":"af4e0ba2-656a-374f-aa93-8c2cff865683","product":{"name":"azl3 rust 0:1.75.0-31.azl3","vendor":{"name":"Microsoft"}}},{"id":"c63199e2-f3f0-3a17-971f-a00df661b9bf","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"e802a70d-5804-33b9-b60f-cd15cbdad310","product":{"name":"3.0","vendor":{"name":"Wind River"}}}]}}]}