ZI
Vendor
zip-rs
5
CVEs
0
On KEV
5
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115909 New | ZI zip2 zip-rs | 7.5 | Oct 26 | zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction |
| CVE-2026-115908 New | ZI zip2 zip-rs | 7.4 | Oct 26 | zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) |
| CVE-2026-115907 New | ZI zip2 zip-rs | 7.5 | Oct 26 | zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size |
| CVE-2026-115906 New | ZI zip2 zip-rs | 6.5 | Oct 26 | zip: AES Entry HMAC Authentication Bypass on Premature EOF |
| CVE-2026-115905 New | ZI zip2 zip-rs | 10.0 | Oct 26 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE |