Is CVE-2026-115907 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115907 being exploited in the wild.

How severe is CVE-2026-115907?

High severity, with a CVSS score of 7.5, published 26 October 2026.

Which products and versions are affected?

zip (crates.io) >= 5.1.0, < 9.0.0, SEMVER:introduced=5.1.0,fixed=9.0.0; Zip-Rs Zip 5.1.0 through 9.0.0.

How is CVE-2026-115907 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115907?

Check whether you run zip (crates.io) or Zip-Rs Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115907: zip library capacity overflow in legacy decoders

Q: Is there a fix for CVE-2026-115907?

Yes. zip (crates.io): upgrade to 9.0.0 or later. Until then: Disable the legacy-zip feature if legacy compression methods (Shrink, Reduce, Implode) are not required, as the default configuration does not enable it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115907 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-115907?

Check whether you run zip (crates.io) or Zip-Rs Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115907 · Severity: high · CVSS 7.5 · Published 2026-10-26

The zip library for Rust, used to read and write ZIP files, can be forced to panic and crash when processing malicious ZIP archives that declare extremely large uncompressed sizes. An attacker can craft a small ZIP file that claims to contain gigabytes of data, causing the archive-processing application to crash and become unavailable.

Technologies: zip (crates.io), Zip-Rs Zip. Vendors: crates.io, Zip-Rs.

Quick answers

Is CVE-2026-115907 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115907 being exploited in the wild.
How severe is CVE-2026-115907?: High severity, with a CVSS score of 7.5, published 26 October 2026.
Which products and versions are affected?: zip (crates.io) >= 5.1.0, < 9.0.0, SEMVER:introduced=5.1.0,fixed=9.0.0; Zip-Rs Zip 5.1.0 through 9.0.0.
Is there a fix for CVE-2026-115907?: Yes. zip (crates.io): upgrade to 9.0.0 or later. Until then: Disable the legacy-zip feature if legacy compression methods (Shrink, Reduce, Implode) are not required, as the default configuration does not enable it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115907 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115907?: Check whether you run zip (crates.io) or Zip-Rs Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

zip (crates.io): upgrade to 9.0.0 or later
```
cargo update -p zip
```

Disable the legacy-zip feature if legacy compression methods (Shrink, Reduce, Implode) are not required, as the default configuration does not enable it.

Technical details

The ShrinkDecoder, Reduce, and Implode decoders in the legacy-zip feature pass the archive-declared uncompressed size directly to Vec::reserve before validating the compressed stream, causing a capacity overflow panic when the declared size is 0xFFFFFFFFFFFFFFFF. An attacker can craft a malicious ZIP archive with attacker-controlled ZIP64 uncompressed size metadata to trigger this unhandled panic during ZipArchive::extract or read operations, terminating the service.

Affected products

zip-rs zip 5.1.0 through 9.0.0

Identifiers

CVE-2026-115907
GHSA-9hj8-73fh-9963

Timeline

2026-10-26: disclosed
2026-09-16: patched: Fix commit merged to master

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.