Threats tagged 'rustsec-2026-0429'

A vulnerability in the zip crate's ZipArchive::extract() function causes the process to abort when extracting a symlink entry with a large declared uncompressed size. The function allocates memory based on the uncompressed size declared in the archive's central directory without validating it against actual data size or system limits. This can lead to a process abort due to memory allocation failure. The issue affects versions prior to 9.0.0 and was fixed in version 9.0.0.