{"id":"EUVD-2026-109984","enisaUuid":"55051a43-c0eb-387e-8bc5-fb2d2cd3354c","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:32:15 PM","dateUpdated":"Oct 30, 2026, 2:13:49 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963\nhttps://github.com/zip-rs/zip2/pull/991\nhttps://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","aliases":"CVE-2026-115907\nGHSA-9hj8-73fh-9963\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"c5736eb8-3900-310b-81f3-1042144c830f","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"5.1.0, \u003c 9.0.0"}],"enisaIdVendor":[{"id":"d42a4bde-10f1-324d-9234-1f32d6949685","vendor":{"name":"zip-rs"}}],"enisaIdVulnerability":[{"id":"4f967ec5-b065-32eb-82da-d382b9282cce","vulnerability":{"id":"CVE-2026-115907","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:32:15 PM","dateUpdated":"Oct 30, 2026, 2:13:49 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963\nhttps://github.com/zip-rs/zip2/pull/991\nhttps://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109984\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 6, 2026, 7:15:49 AM","vulnerabilityProduct":[{"id":"a803971b-82f3-3622-9e15-385705e22715","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"5.1.0, \u003c 9.0.0"}],"vulnerabilityVendor":[{"id":"a9e80aed-582c-36e9-b0c1-410912547a2a","vendor":{"name":"zip-rs"}}]}},{"id":"c1d9e0a6-24ae-3619-81b4-750f155154c6","vulnerability":{"id":"GHSA-9hj8-73fh-9963","description":"zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size","datePublished":"Oct 29, 2026, 4:40:19 PM","dateUpdated":"Oct 29, 2026, 4:40:19 PM","baseScore":0.0,"references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115907\nhttps://github.com/zip-rs/zip2/pull/991\nhttps://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e\nhttps://github.com/zip-rs/zip2\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109984\n","aliases":"GHSA-9hj8-73fh-9963\nCVE-2026-115907\n","epss":0.0,"dataProcessed":"Nov 6, 2026, 7:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"090fbd03-4d00-367a-b937-f5a5da74dd50","advisory":{"id":"openSUSE-SU-2026:12307-1","description":"python313-uv-0.13.6-1.1 on GA media","summary":"python313-uv-0.13.6-1.1 on GA media","datePublished":"Oct 27, 2026, 12:00:00 AM","dateUpdated":"Oct 28, 2026, 11:19:38 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12307-1.json\nhttps://www.suse.com/security/cve/CVE-2026-115905/\nhttps://www.suse.com/security/cve/CVE-2026-115907/\nhttps://www.suse.com/security/cve/CVE-2026-115908/\n","aliases":"CVE-2026-115905\nCVE-2026-115907\nCVE-2026-115908\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"05d7f99a-2571-39fa-9ffe-b675bf82b4ef","product":{"name":"uv-fish-completion-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"33da3320-70be-335e-b633-6a85a040ad44","product":{"name":"uv-fish-completion-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"369b9ee6-af3b-3443-8c46-df4f18378d6f","product":{"name":"uv-zsh-completion-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"41a19ea8-fc78-3b00-98ec-8a259f1ca9c2","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"4dc9174d-ca15-33fe-9afa-e12953e94b07","product":{"name":"python314-uv-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5960cf4a-6d35-381e-b54b-349c92382fa5","product":{"name":"uv-fish-completion-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"5bc4ed21-fc5d-39c5-97dc-0a1356ef319e","product":{"name":"python313-uv-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"63ba713e-e4ad-3bf7-a2e8-213b51af6c17","product":{"name":"uv-zsh-completion-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"66715771-1725-3622-89db-56b9993a088c","product":{"name":"uv-zsh-completion-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8f6950ff-cb3e-3695-9841-effe85a722de","product":{"name":"python314-uv-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"9632b045-f727-3f2d-9f90-abf294cabfba","product":{"name":"python313-uv-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a479a0a5-ef0e-357b-8f7d-8f835957a094","product":{"name":"python314-uv-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a57c10e3-ea9f-34db-95df-62107e50a24b","product":{"name":"uv-bash-completion-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"acf75047-84e2-35c2-951c-7bfa138c8e3a","product":{"name":"python313-uv-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ad1edc03-cecd-36ce-a95f-27f9aa54e201","product":{"name":"python313-uv-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b8038ecd-e153-3298-bb67-a42f716df154","product":{"name":"uv-zsh-completion-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"bd811bf9-3283-30a2-8541-b290d3be3dc2","product":{"name":"python314-uv-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"bdb5ad41-a62d-399b-95d3-0cf40e27e5b1","product":{"name":"uv-fish-completion-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"bfd01e40-b772-32c8-8ad1-4e0d296f9013","product":{"name":"uv-bash-completion-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"dfb04450-666d-36d4-a7fc-4f4370708ee5","product":{"name":"uv-bash-completion-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"e202162e-56c9-3daa-aa85-c5bc2e1ce137","product":{"name":"uv-bash-completion-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}