zip is a zip library for Rust that supports reading and writing simple ZIP files.

Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable legacy-zip and use ZipArchive::extract(). An attacker-controlled ZIP64 uncompressed size triggers a capacity overflow panic in the Shrink decoder in optimized builds, potentially terminating the affected process. Details When reading a Shrink-compressed entry, ShrinkDecoder::read() buffers the compressed input and reserves output capacity using the entry's declared uncompressed size: rust if !self.streamread { self.streamread = true; let mut compressedbytes = Vec::new(); self.compressedreader.readtoend(&mut compressedbytes)?; self.stream.reserve(self.uncompressedsize as usize); hwunshrink( &compressedbytes, self.uncompressedsize as usize, &mut self.stream, )?; } In version 8.6.0, this is located in [src/legacy/shrink.rs](https://github.com/zip-rs/zip2/blob/771dfc534d2614158af5497ea3dff4d4208d7db1/src/legacy/shrink.rs#L341-L352). The vulnerable legacy codecs are compiled when the legacy-zip Cargo feature is enabled. self.uncompressedsize is populated from ZIP metadata. For ZIP64 entries, an attacker can set it to a 64-bit value independently of the archive's actual compressed payload…

curl https://cve.zerocrew.in/api/cve/CVE-2026-115907