Description
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rustc | 1.53.0+dfsg1-1 | — |
| Debian 13 | rustc | 1.53.0+dfsg1-1 | — |
| Debian 12 | rustc | 1.53.0+dfsg1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | rustc | 1.53.0+dfsg1+llvm-4ubuntu1 | — |
| Ubuntu 20.04 LTS | rustc | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | rustc | No fix yet | — |
| Ubuntu Pro 14.04 LTS | rustc | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | rls +13 | 1.52.1-1.module+el8.4.0+11282+0729bac9 | RHSA-2021:3063 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Devtools 2021 | rust-toolset-1.52 +2 | 1.52.1-1.el7_9 | RHSA-2021:3042 |
| Red Hat Devtools 2021 | rust-toolset-1.52-rls +12 | 1.52.1-2.el7_9 | RHSA-2021:3042 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | rust +1 | 1.52.1-1.module+el8.4.0+641+ca238f88 | RLSA-2021:3063 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | rls +11 | 1.56.1-1.amzn2.0.1 | ALAS2-2022-1816 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | rls +13 | 1.52.1-1.module+el8.4.0+20287+5ada6442 | ELSA-2021-3063 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
federiconbaez/cortex9-rust-zip-size-hint-overflow-model ★ 0 · Nov 6, 2026
Safe-Rust model of core Zip TrustedRandomAccess before/after rust-lang/rust PR #82289 (CVE-2021-28879). Model indices only; not a reproduction.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2021:3042 Red Hat Security Advisory: rust-toolset-1.52 and rust-toolset-1.52-rust security and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2021:3063 Red Hat Security Advisory: rust-toolset:rhel8 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RLSA-2021:3063 Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- ALAS2-2022-1816 Moderate: rust security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 14, 2022
- ELSA-2021-3063 Moderate: rust-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 12, 2021
References
- https://github.com/rust-lang/rust/issues/82282
- https://github.com/rust-lang/rust/pull/82289
- FEDORA-2021-d0ba1901ca vendor-advisory
- FEDORA-2021-b1ba54add6 vendor-advisory
- FEDORA-2021-d7f74f0250 vendor-advisory
- GLSA-202210-09 vendor-advisory