CVE-2026-115906: AES HMAC authentication bypass in Rust zip crate

The Rust zip crate (zip-rs/zip2) versions 0.6.0 through 9.0.0 fails to verify the HMAC-SHA1-80 tag when decrypting WinZip AE-x AES entries if the stream hits premature EOF or the payload is empty. An attacker without the password can forge or truncate encrypted entries undetected. The flaw is fixed in zip 9.0.0.

• CVSS 6.5; affects zip versions 0.6.0 to 9.0.0
• HMAC skipped on premature EOF or zero-length entries
• Fixed in zip 9.0.0; PoC included in upstream tests