These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and use `ZipArchive::extract()`. An attacker-controlled ZIP64 uncompressed size triggers a `capacity overflow` panic in the Shrink decoder in optimized builds, potentially terminating the affected process. This vulnerability affects applications using the zip library with the `legacy-zip` feature enable [truncated]
The CVE-2026-115908 vulnerability in the zip package allows for arbitrary file writes outside the extraction directory due to lexical validation of symlink targets. This issue affects versions 7.2.0 and later, up to 9.0.0-pre3. Exploitation requires knowledge of the absolute extraction destination path, which can be realistic in certain scenarios like CI workspaces or fixed directory paths. The impact is [truncated]
The CVE-2026-115909 vulnerability in the zip library allows for an unbounded memory allocation during the extraction of symbolic links, potentially leading to a denial of service (DoS) attack. This issue arises from the `ZipArchive::extract_internal()` function, which allocates a buffer based on an attacker-declared size before reading any entry data. A specially crafted 112-byte archive can terminate the [truncated]