CVE-2026-115909 zip-rs CVE debrief

Who should care

Defenders who handle ZIP files from untrusted sources, especially in systems that use the zip library, should be aware of this vulnerability and prioritize patching or mitigating it to prevent potential denial of service (DoS) attacks.

Why it matters

The CVE-2026-115909 vulnerability in the zip library allows for an unbounded memory allocation during the extraction of symbolic links, potentially leading to a denial of service (DoS) attack. Defenders should prioritize patching or mitigating this vulnerability, especially in systems that handle ZIP files from untrusted sources.

• Denial of Service (DoS) via unbounded memory allocation
• Potential for resource exhaustion during ZIP file extraction

Technical summary

The `ZipArchive::extract_internal()` function in the zip library allocates a buffer using an attacker-declared size before reading any entry data. This can lead to an unbounded memory allocation, potentially causing a denial of service (DoS) attack. The issue arises from the lack of bounds checking on the `uncompressed_size` value obtained from the central directory record of the ZIP file. A specially crafted 112-byte archive can terminate the extraction process with a `SIGABRT` signal due to this infallible allocation. Defenders should prioritize patching or mitigating this vulnerability, especially in systems that handle ZIP files from untrusted sources.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems that handle ZIP files from untrusted sources, as it can lead to a denial of service.

Recommended defensive actions

• Patch the zip library to version 9.0.0 or later
• Implement bounds checking on the `uncompressed_size` value
• Use a try-except block to handle potential exceptions during ZIP file extraction
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed by the CVE record and the source item from osv_dev. The issue is caused by the unbounded memory allocation in the `ZipArchive::extract_internal()` function. The source code of the vulnerable function is provided, and the affected versions of the zip library are specified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.