7.5

CVE-2026-115909: zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

Awaiting analysis
AliasesDEBIAN-CVE-2026-115909
Published 26-10-2026Last modified 26-10-2026

Vulnerability summary

CVE-2026-115909 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in zip-rs zip2.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 26-10-2026
    PublishedVulnerability first disclosed.
  2. 26-10-2026
    Last modifiedVulnerability information updated.

Description

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • rust-zipAll versions (No fix recorded)
Zip-rs1 product
  • zip2≥ 1.3.0, < 9.0.0

2 vendors · 2 products

References

5 links