[ Vendor · 5 CVEs ]
zip-rs
CVEs affecting zip-rs published in the last 30 days, plus any zip-rs CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-115907 | 26 Oct 2026 | CVSS 7.5 | zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizezip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip… | Fix |
| CVE-2026-115908 | 26 Oct 2026 | CVSS 7.4 | zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and… | Fix |
| CVE-2026-115909 | 26 Oct 2026 | CVSS 7.5 | zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extractionzip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs… | Fix |
| CVE-2026-115905 | 26 Oct 2026 | CVSS 10.0 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEzip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header… | Fix |
| CVE-2026-115906 | 26 Oct 2026 | CVSS 6.5 | zip: AES Entry HMAC Authentication Bypass on Premature EOFzip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies… | Fix |