{"id":"EUVD-2026-109984","enisaUuid":"55051a43-c0eb-387e-8bc5-fb2d2cd3354c","description":"zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size","datePublished":"Oct 29, 2026, 4:40:19 PM","dateUpdated":"Oct 29, 2026, 4:40:19 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963\nhttps://github.com/zip-rs/zip2/pull/991\nhttps://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115907\n","aliases":"CVE-2026-115907\nGHSA-9hj8-73fh-9963\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"c5736eb8-3900-310b-81f3-1042144c830f","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"5.1.0, \u003c 9.0.0"}],"enisaIdVendor":[{"id":"d42a4bde-10f1-324d-9234-1f32d6949685","vendor":{"name":"zip-rs"}}],"enisaIdVulnerability":[{"id":"4f967ec5-b065-32eb-82da-d382b9282cce","vulnerability":{"id":"CVE-2026-115907","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:32:15 PM","dateUpdated":"Oct 26, 2026, 4:32:15 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963\nhttps://github.com/zip-rs/zip2/pull/991\nhttps://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109984\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 29, 2026, 7:14:41 AM","vulnerabilityProduct":[{"id":"a803971b-82f3-3622-9e15-385705e22715","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"5.1.0, \u003c 9.0.0"}],"vulnerabilityVendor":[{"id":"a9e80aed-582c-36e9-b0c1-410912547a2a","vendor":{"name":"zip-rs"}}]}},{"id":"c1d9e0a6-24ae-3619-81b4-750f155154c6","vulnerability":{"id":"GHSA-9hj8-73fh-9963","description":"zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size","datePublished":"Oct 29, 2026, 4:40:19 PM","dateUpdated":"Oct 29, 2026, 4:40:19 PM","baseScore":0.0,"references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115907\nhttps://github.com/zip-rs/zip2/pull/991\nhttps://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e\nhttps://github.com/zip-rs/zip2\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109984\n","aliases":"GHSA-9hj8-73fh-9963\nCVE-2026-115907\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 8:01:07 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}