Security1 hOctober 30, 2026, 05:30

Rust zip crate flaw lets crafted archives abort processes

CVE-2026-115909 in the Rust zip crate (versions 1.3.0 to before 9.0.0) lets crafted ZIP archives trigger an uncatchable SIGABRT via an oversized symlink target size. Version 9.0.0 caps symlink targets at 4,096 bytes.

DEV Community

Open source

Affects zip >= 1.3.0 and < 9.0.0, CVSS 7.5
A 112-byte ZIP64 archive triggers SIGABRT via Vec::with_capacity
zip 9.0.0 adds MAX_SYMLINK_TARGET_LEN of 4,096 bytes
Public PoC is available

#Rust#Zip

CVE-2026-115906: AES HMAC authentication bypass in Rust zip crate

Software

Rust proposes cross-crate forward declarations to replace weak symbols

Security

Critical Pillow flaw lets crafted EPS image execute code on servers

Software

Rust zip crate flaw lets crafted archives abort processes

CVE-2026-115906: AES HMAC authentication bypass in Rust zip crate

Rust proposes cross-crate forward declarations to replace weak symbols

Critical Pillow flaw lets crafted EPS image execute code on servers

Rust Coreutils 0.12 vs GNU 9.12: process startup nearly 3x slower