{"id":"EUVD-2026-109987","enisaUuid":"64128014-48a0-32c7-b5e8-caddf96c7d1e","description":"zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction","datePublished":"Oct 29, 2026, 4:40:01 PM","dateUpdated":"Oct 29, 2026, 4:40:01 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3\nhttps://github.com/zip-rs/zip2/pull/984\nhttps://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115909\n","aliases":"CVE-2026-115909\nGHSA-q7v9-x93c-xqv3\n","assigner":"GitHub_M","epss":0.46,"enisaIdProduct":[{"id":"b5c17958-0dd0-3157-a798-431d2830150d","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"1.3.0, \u003c 9.0.0"}],"enisaIdVendor":[{"id":"612215c0-4bb5-3c8d-87da-0e62fd65a282","vendor":{"name":"zip-rs"}}],"enisaIdVulnerability":[{"id":"5ebba247-572b-3c38-83ee-25dda7e5373f","vulnerability":{"id":"CVE-2026-115909","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:39:00 PM","dateUpdated":"Oct 26, 2026, 7:48:35 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3\nhttps://github.com/zip-rs/zip2/pull/984\nhttps://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109987\n","assigner":"GitHub_M","epss":0.46,"dataProcessed":"Oct 29, 2026, 7:14:41 AM","vulnerabilityProduct":[{"id":"ad1dd245-e7d8-32e1-8692-e958f471a3cb","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"1.3.0, \u003c 9.0.0"}],"vulnerabilityVendor":[{"id":"d16068dd-f114-375b-a0a6-e178342e619b","vendor":{"name":"zip-rs"}}]}},{"id":"9d64b81d-b215-3115-92b2-f8b4e63a002a","vulnerability":{"id":"GHSA-q7v9-x93c-xqv3","description":"zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction","datePublished":"Oct 29, 2026, 4:40:01 PM","dateUpdated":"Oct 29, 2026, 4:40:01 PM","baseScore":0.0,"references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115909\nhttps://github.com/zip-rs/zip2/pull/984\nhttps://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98\nhttps://github.com/zip-rs/zip2\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109987\n","aliases":"CVE-2026-115909\nGHSA-q7v9-x93c-xqv3\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 8:01:07 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}