crates.ioPackage

zip

6 known vulnerabilities (1 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 9.4.2 (Nov 7, 2026): no advisory affects it
Newest unaffected release: 9.4.2 (Nov 7, 2026), the latest release
Advisories: 6 · 1 critical, 4 high, 1 medium

Weekly downloads: 7.5M
Releases: 149 since 0.0.1 (Nov 21, 2014)
Registry: crates.io
Releases read: Nov 8, 2026

Version timeline

CVE-2026-115909
Affects 0.0.1 to 9.0.0-pre3 (9.0.0 is outside it)
CVE-2026-115908
Affects 7.2.0 to 9.0.0-pre3 (9.0.0 is outside it)
CVE-2026-115907
Affects 5.1.0 to 9.0.0-pre3 (9.0.0 is outside it)
CVE-2026-115906
Affects 0.6.0 to 9.0.0-pre3 (9.0.0 is outside it)
CVE-2026-115905
Affects 0.0.1 to 9.0.4 (9.0.5 is outside it)
CVE-2025-29787
Affects 1.3.0 to 2.2.3 (2.3.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2026-115909High 7.5
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
Affected: from 1.3.0, fixed in 9.0.0; fixed in 9.0.0.
Fixed in 9.0.0 (released Oct 9, 2026, 17 days before disclosure).
The latest release, 9.4.2, is not affected.
CVE-2026-115908High 7.4
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)
Affected: from 7.2.0, fixed in 9.0.0.
Fixed in 9.0.0 (released Oct 9, 2026, 17 days before disclosure).
The latest release, 9.4.2, is not affected.
CVE-2026-115907High 7.5
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
Affected: from 5.1.0, fixed in 9.0.0.
Fixed in 9.0.0 (released Oct 9, 2026, 17 days before disclosure).
The latest release, 9.4.2, is not affected.
CVE-2026-115906Medium 6.5
zip: AES Entry HMAC Authentication Bypass on Premature EOF
Affected: from 0.6.0, fixed in 9.0.0.
Fixed in 9.0.0 (released Oct 9, 2026, 17 days before disclosure).
The latest release, 9.4.2, is not affected.
CVE-2026-115905Critical 10.0
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File…
Affected: fixed in 9.0.5.
Fixed in 9.0.5 (released Oct 17, 2026, 9 days before disclosure).
The latest release, 9.4.2, is not affected.
CVE-2025-29787High 7.3
zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write
Affected: from 1.3.0, fixed in 2.3.0.
Fixed in 2.3.0 (released Mar 16, 2025, 1 day before disclosure).
The latest release, 9.4.2, is not affected.