Quick answers
- Is CVE-2026-115909 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115909 being exploited in the wild.
- How severe is CVE-2026-115909?
- High severity, with a CVSS score of 7.5, published 26 October 2026.
- Which products and versions are affected?
- zip (crates.io) >= 1.3.0, < 9.0.0, SEMVER:introduced=0.0.0-0,fixed=9.0.0, SEMVER:introduced=1.3.0,fixed=9.0.0; Zip-Rs Zip 1.3.0 to 8.x.
- Is there a fix for CVE-2026-115909?
- Yes. zip (crates.io): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-115909 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-115909?
- Check whether you run zip (crates.io) or Zip-Rs Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- zip (crates.io): upgrade to 9.0.0 or later
cargo update -p zip
Technical details
ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity with the attacker-controlled ZIP64 uncompressed_size field before validating or reading entry data, allowing a symlink entry to request allocation of up to 2^62 bytes or trigger a capacity-overflow panic. The infallible allocation path aborts the process before the entry is validated, and this failure cannot be caught with catch_unwind or isolated in a worker thread. The fix caps pre-allocation to MAX_SYMLINK_TARGET_LEN (4096 bytes) and rejects oversized entries as InvalidArchive.
Affected products
- zip-rs zip 1.3.0 to 8.x
Identifiers
- CVE-2026-115909
- GHSA-q7v9-x93c-xqv3
- RUSTSEC-2026-0429
Timeline
- 2026-10-26: disclosed
- 2026-09-14: patched