https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 11:06:12 +0000 https://db.gcve.eu/vuln/cve-2026-115909 <p><strong>Affected:</strong> zip-rs zip2</p> <p>zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.</p> <p><strong>Affected:</strong> zip-rs zip2</p> <p>zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.</p> https://db.gcve.eu/vuln/cve-2026-115909 https://db.gcve.eu/vuln/rustsec-2026-0429 <p><strong>Affected:</strong> crates.io: zip</p> <p>`ZipArchive::extract()` sizes the symlink-target buffer from the uncompressed size declared in the central directory record, before reading a single byte of entry data:</p> <p>```rust let mut target = Vec::with_capacity(file.size() as usize); ```</p> <p>Both inputs are attacker-controlled. `ZipFile::size()` returns `uncompressed_size` verbatim from the central directory, widened to a full `u64` by a ZIP64 extended-information extra field, and is never cross-checked against the compressed size, the remaining archive length, or any platform-appropriate bound for a symlink target. `ZipFile::is_symlink()` is decided entirely by the `S_IFLNK` bit of the external-attributes field.</p> <p>`Vec::with_capacity()` is infallible: when the reservation is refused it calls `handle_alloc_error()` and aborts the process. This is not a Rust panic. It is not caught by `catch_unwind()`, is unaffected by `panic = &#34;unwind&#34;`, and is not contained by running the call on a worker thread.</p> <p>A 112-byte archive is sufficient. One `Stored` entry flagged `S_IFLNK` with a ZIP64 field declaring `uncompressed_size = 2^62` and a zero-byte payload makes `extract()` fail with:</p> <p>``` memory allocation of 4611686018427387904 bytes failed Aborted (core dumped) # exit 134 ```</p> <p>The declared value only needs to exceed the host&#39;s address space, not its RAM: `Vec::with_capacity()` maps address space without touching pages, so resident memory stays flat and the abort happens on the refused reservation itself. Under a `ulimit -v`…</p> <p><strong>Affected:</strong> crates.io: zip</p> <p>`ZipArchive::extract()` sizes the symlink-target buffer from the uncompressed size declared in the central directory record, before reading a single byte of entry data:</p> <p>```rust let mut target = Vec::with_capacity(file.size() as usize); ```</p> <p>Both inputs are attacker-controlled. `ZipFile::size()` returns `uncompressed_size` verbatim from the central directory, widened to a full `u64` by a ZIP64 extended-information extra field, and is never cross-checked against the compressed size, the remaining archive length, or any platform-appropriate bound for a symlink target. `ZipFile::is_symlink()` is decided entirely by the `S_IFLNK` bit of the external-attributes field.</p> <p>`Vec::with_capacity()` is infallible: when the reservation is refused it calls `handle_alloc_error()` and aborts the process. This is not a Rust panic. It is not caught by `catch_unwind()`, is unaffected by `panic = &#34;unwind&#34;`, and is not contained by running the call on a worker thread.</p> <p>A 112-byte archive is sufficient. One `Stored` entry flagged `S_IFLNK` with a ZIP64 field declaring `uncompressed_size = 2^62` and a zero-byte payload makes `extract()` fail with:</p> <p>``` memory allocation of 4611686018427387904 bytes failed Aborted (core dumped) # exit 134 ```</p> <p>The declared value only needs to exceed the host&#39;s address space, not its RAM: `Vec::with_capacity()` maps address space without touching pages, so resident memory stays flat and the abort happens on the refused reservation itself. Under a `ulimit -v`…</p> https://db.gcve.eu/vuln/rustsec-2026-0429