# CVE-2026-115909: zip Rust library denial of service in symlink extraction

Source: https://junglewise.ai/threats/cve-2026-115909-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115909 · Severity: high · CVSS 7.5 · Published 2026-10-26

The zip library for Rust, used to read and write ZIP files, contains a denial-of-service flaw in its archive extraction feature. An attacker can craft a malicious ZIP file with a symbolic link entry that declares an impossibly large size, causing the library to attempt a massive memory allocation that crashes the entire application—a failure that cannot be caught or handled by the calling code. This allows repeated denial-of-service attacks against any application that processes untrusted ZIP archives.

Technologies: [zip (crates.io)](https://junglewise.ai/threats/technologies/zip), [Zip-Rs Zip](https://junglewise.ai/threats/technologies/zip-rs-zip). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Zip-Rs](https://junglewise.ai/threats/vendors/zip-rs).

## Quick answers

**Is CVE-2026-115909 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115909 being exploited in the wild.

**How severe is CVE-2026-115909?** High severity, with a CVSS score of 7.5, published 26 October 2026.

**Which products and versions are affected?** zip (crates.io) >= 1.3.0, < 9.0.0, SEMVER:introduced=0.0.0-0,fixed=9.0.0, SEMVER:introduced=1.3.0,fixed=9.0.0; Zip-Rs Zip 1.3.0 to 8.x.

**Is there a fix for CVE-2026-115909?** Yes. zip (crates.io): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115909 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115909?** Check whether you run zip (crates.io) or Zip-Rs Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- zip (crates.io): upgrade to 9.0.0 or later

  ```sh
  cargo update -p zip
  ```


## Technical details

ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity with the attacker-controlled ZIP64 uncompressed_size field before validating or reading entry data, allowing a symlink entry to request allocation of up to 2^62 bytes or trigger a capacity-overflow panic. The infallible allocation path aborts the process before the entry is validated, and this failure cannot be caught with catch_unwind or isolated in a worker thread. The fix caps pre-allocation to MAX_SYMLINK_TARGET_LEN (4096 bytes) and rejects oversized entries as InvalidArchive.

## Affected products

- zip-rs zip 1.3.0 to 8.x

## Identifiers

- CVE-2026-115909
- GHSA-q7v9-x93c-xqv3
- RUSTSEC-2026-0429

## Timeline

- 2026-10-26: disclosed
- 2026-09-14: patched

## References

- [https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98](https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98)
- [https://github.com/zip-rs/zip2/pull/984](https://github.com/zip-rs/zip2/pull/984)

## Related threats

- [zip symlink escape vulnerability in extract](https://junglewise.ai/threats/cve-2026-115908-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing)
- [zip library capacity overflow in legacy decoders](https://junglewise.ai/threats/cve-2026-115907-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing)
- [zip library authentication bypass in AES entry reader](https://junglewise.ai/threats/cve-2026-115906-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing)
- [zip library path traversal via Central Directory mismatch](https://junglewise.ai/threats/cve-2026-115905-zip-is-a-zip-library-for-rust-that-supports-reading-and-writing)
- [RUSTSEC-2026-0369 - ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks…](https://junglewise.ai/threats/rustsec-2026-0369-zipstreamreader-extract-and-ziparchive-extract-apply-427bba66)