Summary
### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and use `ZipArchive::extract()`. An attacker-controlled ZIP64 uncompressed size triggers a `capacity overflow` panic in the Shrink decoder in optimized builds, potentially terminating the affected process. ### Details When reading a Shrink-compressed entry, `ShrinkDecoder::read()` buffers the compressed input and reserves output capacity using the entry's declared uncompressed size: ```rust if !self.stream_read { self.stream_read = true; let mut compressed_bytes = Vec::new(); self.compressed_reader.read_to_end(&mut compressed_bytes)?; self.stream.reserve(self.uncompressed_size as usize); hwunshrink( &compressed_bytes, self.uncompressed_size as usize, &mut self.stream, )?; } ``` In version 8.6.0, this is located in [`src/legacy/shrink.rs`](https://github.com/zip-rs/zip2/blob/771dfc534d2614158af5497ea3dff4d4208d7db1/src/legacy/shrink.rs#L341-L352). The vulnerable legacy codecs are compiled when the `legacy-zip` Cargo feature is enabled. `self.uncompressed_size` is populated from ZIP metadata. For ZIP64 entries, an attacker can set it to a 64-bit value independently of the archive's actual compressed payload size. The PoC declares an uncompressed size of `u64::MAX`, while supplying only one byte of compressed data. The reserve occurs before `hwunshrink()` can validate or decode the compressed stream. Consequently, the impossible capacity causes a deterministic `capacity overflow` panic instead of returning a normal archive or I/O error. The behavior also occurs in optimized release builds and is reachable through `ZipArchive::extract()`. The same unbounded allocation pattern is present in the legacy Reduce and Implode decoder implementations. This PoC specifically demonstrates the Shrink path. ### PoC Create a new Cargo project with the following layout: ```text zip2-legacy-poc/ |-- Cargo.toml `-- src/ `-- main.rs ``` Use this `Cargo.toml`: ```toml [pack…
Remediation
References
- Advisoryhttps://github.com/advisories/GHSA-9hj8-73fh-9963
- Referencehttps://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963
- Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-115907
- Referencehttps://github.com/zip-rs/zip2/pull/991
- Referencehttps://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e
- Referencehttps://github.com/zip-rs/zip2/releases/tag/v9.0.0