{"id":"EUVD-2026-109983","enisaUuid":"6b604de2-7d5a-3986-8474-40f70285f9ca","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:30:30 PM","dateUpdated":"Oct 31, 2026, 1:32:55 AM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4\nhttps://github.com/zip-rs/zip2/commit/ec265db0b0602f8ffb9479327397bddefb7e2216\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","aliases":"CVE-2026-115906\nGHSA-8hxf-qr8p-62x4\n","assigner":"GitHub_M","epss":0.15,"enisaIdProduct":[{"id":"a08b8325-23bb-38e7-a462-981ab5dcca4d","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"0.6.0, \u003c 9.0.0"}],"enisaIdVendor":[{"id":"5eba151a-2a6d-39e3-8d42-c5675aa02a25","vendor":{"name":"zip-rs"}}],"enisaIdVulnerability":[{"id":"9ba5221f-013e-31fb-abd6-127c3fe5200c","vulnerability":{"id":"CVE-2026-115906","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:30:30 PM","dateUpdated":"Oct 31, 2026, 1:32:55 AM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4\nhttps://github.com/zip-rs/zip2/commit/ec265db0b0602f8ffb9479327397bddefb7e2216\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109983\n","assigner":"GitHub_M","epss":0.15,"dataProcessed":"Oct 31, 2026, 9:00:40 PM","vulnerabilityProduct":[{"id":"980eaa8e-111c-3254-b302-01773d18ad8c","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"0.6.0, \u003c 9.0.0"}],"vulnerabilityVendor":[{"id":"331af110-177e-323a-a6dd-2767f6c9ee1e","vendor":{"name":"zip-rs"}}]}},{"id":"a0590a82-55da-3dca-94f5-675b473472ff","vulnerability":{"id":"GHSA-8hxf-qr8p-62x4","description":"zip: AES Entry HMAC Authentication Bypass on Premature EOF","datePublished":"Oct 29, 2026, 4:40:07 PM","dateUpdated":"Oct 29, 2026, 4:40:07 PM","baseScore":0.0,"references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115906\nhttps://github.com/zip-rs/zip2/commit/ec265db0b0602f8ffb9479327397bddefb7e2216\nhttps://github.com/zip-rs/zip2\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109983\n","aliases":"GHSA-8hxf-qr8p-62x4\nCVE-2026-115906\n","epss":0.0,"dataProcessed":"Oct 31, 2026, 9:01:46 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}