zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-115909 · Microsoft / collected KEV context

EUVD-2026-109987

GHSA-q7v9-x93c-xqv3

RUSTSEC-2026-0429

cve-program · CVE-2026-115909

• https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3
• https://github.com/zip-rs/zip2/pull/984
• https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98
• https://github.com/zip-rs/zip2/releases/tag/v9.0.0

euvd · EUVD-2026-109987

• https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3
• https://github.com/zip-rs/zip2/pull/984
• https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98
• https://github.com/zip-rs/zip2/releases/tag/v9.0.0

nvd · CVE-2026-115909

• https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98
• https://github.com/zip-rs/zip2/pull/984
• https://github.com/zip-rs/zip2/releases/tag/v9.0.0
• https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3

osv · GHSA-q7v9-x93c-xqv3

• https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3
• https://nvd.nist.gov/vuln/detail/CVE-2026-115909
• https://github.com/zip-rs/zip2/pull/984
• https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98
• https://github.com/zip-rs/zip2
• https://github.com/zip-rs/zip2/releases/tag/v9.0.0

osv · RUSTSEC-2026-0429

• https://crates.io/crates/zip
• https://rustsec.org/advisories/RUSTSEC-2026-0429.html

• zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared size · Newly collected advisory · 2 Nov 2026
• zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction · Advisory content revised · 2 Nov 2026
• zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompr… · Advisory content revised · 31 Oct 2026
• zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction · Newly collected advisory · 29 Oct 2026
• zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction · Newly collected advisory · 26 Oct 2026