https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 02:10:00 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115907 <p>zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.</p> <p>zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115907 https://db.gcve.eu/vuln/opensuse-su-2026:12307-1 <p>python313-uv-0.13.6-1.1 on GA media</p> <p>python313-uv-0.13.6-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:12307-1 https://db.gcve.eu/vuln/ubuntu-cve-2026-115907 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: rust-zip, Ubuntu:22.04:LTS: rust-zip, Ubuntu:24.04:LTS: rust-zip, Ubuntu:26.10: rust-zip, Ubuntu:26.04:LTS: rust-zip</p> <p>zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: rust-zip, Ubuntu:22.04:LTS: rust-zip, Ubuntu:24.04:LTS: rust-zip, Ubuntu:26.10: rust-zip, Ubuntu:26.04:LTS: rust-zip</p> <p>zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-115907