Threats affecting pkg:cargo/zip

A denial of service vulnerability exists in the zip crate versions 5.1.0 up to but not including 9.0.0 when the legacy-zip feature is enabled. An attacker can craft a malicious ZIP64 archive with an uncompressed size set to an extremely large value, causing a capacity overflow panic in the Shrink decoder during extraction. This panic terminates the affected process, leading to denial of service. The issue arises because the decoder reserves output buffer capacity based on the uncompressed size from ZIP metadata before validating the compressed data size. This vulnerability is fixed in version 9.0.0.

A vulnerability in the zip crate (versions 7.2.0 up to but not including 9.0.0) allows an attacker to write arbitrary files outside the intended extraction directory by exploiting symlink validation flaws. The issue arises because the path validation is purely lexical and absolute symlink targets are not properly rejected, enabling directory traversal outside the extraction target. This is especially impactful on Windows, where a single symlink can redirect extraction to a different drive or remote share. The vulnerability requires the attacker to know or guess the absolute extraction path. The issue was introduced by a change in path handling in version 7.2.0 and fixed in version 9.0.0.

A vulnerability in the zip crate's AES-encrypted entry handling allows an attacker to bypass HMAC authentication if the entry's declared compressed size exceeds the actual data length, causing premature EOF. This results in truncated, unauthenticated plaintext being accepted without error. Zero-payload entries also bypass authentication. The flaw affects versions from 0.6.0 up to but not including 9.0.0 and is fixed in version 9.0.0.

A vulnerability in the zip crate (versions >=1.3.0 <9.0.0) allows an attacker to cause an uncatchable process abort during extraction by specifying an unbounded symlink target size. The flaw arises because the symbolic-link extraction code allocates memory based on an attacker-controlled size from the ZIP central directory without bounds checking. This leads to an infallible allocation failure that aborts the process, causing denial of service. The issue is fixed in version 9.0.0.

Two serious vulnerabilities were found in the Rust zip crate, a widely used library for handling ZIP files. The first (RUSTSEC-2026-0367) allows privilege escalation by preserving dangerous file permission bits (setuid, setgid, sticky bit) when extracting archives, potentially enabling attackers to plant setuid-root files. The second (CVE-2026-115905) is a critical remote code execution flaw caused by inconsistent handling of file names between the central directory and local headers in ZIP archives, allowing arbitrary file overwrite and execution. Both vulnerabilities are fixed in version 9.0.5 of the zip crate. The advisory emphasizes that patching alone is insufficient and advocates architectural security using deny-by-default sandboxes to contain untrusted code and limit the impact of such vulnerabilities.

A critical vulnerability in the zip crate (<= 9.0.4) arises from inconsistent parsing of ZIP archive headers between two readers: ZipArchive uses the Central Directory File Header (CDFH) as authoritative, while ZipStreamReader relies on the Local File Header (LFH). This discrepancy allows an attacker to craft a ZIP archive with differing filenames in the headers, enabling security gateways to be bypassed and malicious files to be extracted, leading to arbitrary file overwrite and potential remote code execution.