A vulnerability in adm-zip version 0.6.0 allows bypassing decompression-bomb protection by setting the declared uncompressed size in a ZIP entry to zero. This causes the decompression output size limit to be ignored, potentially leading to excessive memory allocation and process crashes. The issue arises because the decompression cap is only applied when the declared size is greater than zero. A patch is available to address this flaw.