# CVE-2026-115907: zip library capacity overflow in legacy decoders

Source: https://junglewise.ai/threats/cve-2026-115907-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115907 · Severity: high · CVSS 7.5 · Published 2026-10-26

The zip library for Rust, used to read and write ZIP files, can be forced to panic and crash when processing malicious ZIP archives that declare extremely large uncompressed sizes. An attacker can craft a small ZIP file that claims to contain gigabytes of data, causing the archive-processing application to crash and become unavailable.

Technologies: [zip (crates.io)](https://junglewise.ai/threats/technologies/zip), [Zip-Rs Zip](https://junglewise.ai/threats/technologies/zip-rs-zip). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Zip-Rs](https://junglewise.ai/threats/vendors/zip-rs).

## Quick answers

**Is CVE-2026-115907 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115907 being exploited in the wild.

**How severe is CVE-2026-115907?** High severity, with a CVSS score of 7.5, published 26 October 2026.

**Which products and versions are affected?** zip (crates.io) >= 5.1.0, < 9.0.0, SEMVER:introduced=5.1.0,fixed=9.0.0; Zip-Rs Zip 5.1.0 through 9.0.0.

**Is there a fix for CVE-2026-115907?** Yes. zip (crates.io): upgrade to 9.0.0 or later. Until then: Disable the legacy-zip feature if legacy compression methods (Shrink, Reduce, Implode) are not required, as the default configuration does not enable it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115907 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115907?** Check whether you run zip (crates.io) or Zip-Rs Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- zip (crates.io): upgrade to 9.0.0 or later

  ```sh
  cargo update -p zip
  ```


Disable the legacy-zip feature if legacy compression methods (Shrink, Reduce, Implode) are not required, as the default configuration does not enable it.

## Technical details

The ShrinkDecoder, Reduce, and Implode decoders in the legacy-zip feature pass the archive-declared uncompressed size directly to Vec::reserve before validating the compressed stream, causing a capacity overflow panic when the declared size is 0xFFFFFFFFFFFFFFFF. An attacker can craft a malicious ZIP archive with attacker-controlled ZIP64 uncompressed size metadata to trigger this unhandled panic during ZipArchive::extract or read operations, terminating the service.

## Affected products

- zip-rs zip 5.1.0 through 9.0.0

## Identifiers

- CVE-2026-115907
- GHSA-9hj8-73fh-9963

## Timeline

- 2026-10-26: disclosed
- 2026-09-16: patched: Fix commit merged to master

## References

- [https://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e](https://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e)
- [https://github.com/zip-rs/zip2/pull/991](https://github.com/zip-rs/zip2/pull/991)

## Related threats

- [zip Rust library denial of service in symlink extraction](https://junglewise.ai/threats/cve-2026-115909-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing)
- [zip symlink escape vulnerability in extract](https://junglewise.ai/threats/cve-2026-115908-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing)
- [zip library authentication bypass in AES entry reader](https://junglewise.ai/threats/cve-2026-115906-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing)
- [zip library path traversal via Central Directory mismatch](https://junglewise.ai/threats/cve-2026-115905-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing)
- [RUSTSEC-2026-0369 - ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks…](https://junglewise.ai/threats/rustsec-2026-0369-zipstreamreader-extract-and-ziparchive-extract-apply-427bba66)