SZB-13a464fc98
Critical Rust zip library flaw CVE-2026-115905 reported
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Rust
- Product
- zip crate
- First seen
Summary
A Mastodon post linking to securityonline.info says CVE-2026-115905 in the Rust zip library lets attackers bypass security gateways and overwrite server files using ZIP header discrepancies. The post does not name a patched version.
If you use Rust
Check whether your projects depend on the Rust zip crate and which version they use
Update to the fixed zip release once the advisory names it
Validate archive entry paths and header consistency before extracting untrusted archives
What the sources say 1
· Mastodon: “A critical Rust zip vulnerability CVE-2026-115905 allows attackers to bypass security gateways and overwrite server files using ZIP header discrepancies.” Source