CVE-2026-115905

Summary

A critical architectural parser differential exists in the zip crate (<= 9.0.4) between random-access archive readers (ZipArchive) and streaming readers (ZipStreamReader). ZipArchive considers the Central Directory File Header (CDFH) authoritative and ignores the filename declared in the Local File Header (LFH). In contrast, ZipStreamReader relies exclusively on the Local File Header (LFH) when extracting files to the filesystem.

This discrepancy enables ZIP archives to appear to have different file paths and contents according to which tool is reading them.

Details

Architectural Root Cause

In the PKWARE ZIP archive format, every file entry is defined in two distinct locations:

1. Local File Header (LFH): Precedes the compressed payload of each file in the body of the archive.
2. Central Directory File Header (CDFH): Stored in a contiguous index at the end of the archive.

In zip2:

• src/read/zip_archive.rs: ZipArchive parses the central directory into SharedBuilder.files. All file lookups by index or name read exclusively from the CDFH table, completely ignoring the filename present in the LFH.
• src/read/stream.rs:L86-L141: ZipStreamReader::visit and ZipStreamReader::extract read sequentially from the stream without verifying the central directory index. Each entry is parsed via read_zipfile_from_stream and written to disk using the unverified filename declared in the LFH:

  // src/read/stream.rs
  fn visit_file<R: Read>(&mut self, file: &mut ZipFile<'_, R>) -> ZipResult<()> {
      file.safe_prepare_path(&self.outpath, &mut outpath, None::<&(_, fn(&Path) -> bool)>)?;
      let mut outfile = fs::File::create(&outpath)?;
      io::copy(file, &mut outfile)?;
      Ok(())
  }
  

• src/write.rs:L1552: The crate explicitly exposes shallow_copy_file, an API that constructs dual-header desynchronizations by adding a new CDFH entry with an alias name pointing to an existing file without updating the original LFH.

Threat Scenario & Severity Justification (10.0 / 9.9 Critical)

1. Security Control Evasion: An adversary crafts a ZIP archive where:
   • Central Directory Header declares: doc_report.pdf (Clean document)
   • Local File Header declares: cron_worker.sh (Malicious root backdoor)
2. The archive is uploaded through a web portal or API endpoint protected by security gateways (WAF, Anti-Virus, Content Disarm & Reconstruction). The security gateway inspects the archive using ZipArchive (or similar CDFH-first parsers), detects only doc_report.pdf, and approves the file.
3. The backend worker or cloud function receives the approved archive and extracts it using ZipStreamReader::extract. ZipStreamReader reads the LFH and overwrites cron_worker.sh.
4. Full Compromise (CIA = High): The legitimate production health checker / service script is destroyed (Availability = High / DoS), while the attacker's backdoor payload is implanted (Integrity = High / RCE).

Proof of Concept

The following automated integration test reproducibly demonstrates the complete CVSS 10.0 / 9.9 exploit chain (Security Gateway Evasion -> Arbitrary File Overwrite -> RCE & DoS) against zip2:

use std::fs;
use std::io::{Cursor, Write};
use tempfile::tempdir;
use zip::unstable::stream::ZipStreamReader;
use zip::write::SimpleFileOptions;
use zip::{ZipArchive, ZipWriter};

// Simulated Security Gateway (inspects CDFH via ZipArchive)
fn security_gateway_inspection(archive_bytes: &[u8]) -> Result<(), String> {
    let mut archive = ZipArchive::new(Cursor::new(archive_bytes)).unwrap();
    for i in 0..archive.len() {
        let name = archive.by_index(i).unwrap().name().unwrap().to_string();
        if name.ends_with(".sh") || name.ends_with(".exe") {
            return Err(format!("MALWARE DETECTED: '{}' blocked!", name));
        }
        if !name.ends_with(".pdf") {
            return Err("Policy violation: only PDFs allowed!".into());
…

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

These are all security issues fixed in the python313-uv-0.13.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the keylime-ima-policy-0.2.10+12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gleam-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rust-keylime fixes the following issue:

• CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers (bsc#1287921)
• CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921)
• CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
• CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
• CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921)

Changes for rust-keylime:

• Update to version 0.2.10+12:

• log Agent UUID at push agent startup
• Limit actix-web workers
• Fix clippy needless_late_init warnings
• Unwrap OCTET STRING wrapped EK certificates
• build(deps): bump rand from 0.9.4 to 0.10.1
• build(deps): bump glob from 0.3.3 to 0.3.4
• build(deps): bump reqwest from 0.13.3 to 0.13.4
• Check shutdown marker inside ml_extend loop
• Fix clippy useless_borrows_in_formatting warnings
• build(deps): bump tokio from 1.52.2 to 1.53.1
• Fix payload key upgrade regression by falling back to mTLS key
• Accept any RSA key size for payload encryption
• Bump version to 0.2.10
• keylime: use runtime OpenSSL algorithm detection instead of compile-time symbols

This update for rust-keylime fixes the following issue:

• CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers (bsc#1287921)
• CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921)
• CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
• CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
• CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921)

Changes for rust-keylime:

• Update to version 0.2.10+12:

• log Agent UUID at push agent startup
• Limit actix-web workers
• Fix clippy needless_late_init warnings
• Unwrap OCTET STRING wrapped EK certificates
• build(deps): bump rand from 0.9.4 to 0.10.1
• build(deps): bump glob from 0.3.3 to 0.3.4
• build(deps): bump reqwest from 0.13.3 to 0.13.4
• Check shutdown marker inside ml_extend loop
• Fix clippy useless_borrows_in_formatting warnings
• build(deps): bump tokio from 1.52.2 to 1.53.1
• Fix payload key upgrade regression by falling back to mTLS key
• Accept any RSA key size for payload encryption
• Bump version to 0.2.10
• keylime: use runtime OpenSSL algorithm detection instead of compile-time symbols