Description
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zip-rs | zip2 | >= 5.1.0, < 9.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-zip | No fix yet | — |
| Debian 13 | rust-zip | No fix yet | — |
| Debian 12 | rust-zip | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-zip | No fix yet | — |
| Ubuntu 26.04 LTS | rust-zip | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | rust-keylime | 0.2.10+12-160000.1.1 | SUSE-SU-2026:24658-1 |
| SLES 16.0 | rust-keylime | 0.2.10+12-160000.1.1 | SUSE-SU-2026:24658-1 |
| SLE Micro 6.2 | rust-keylime | 0.2.10+12-160000.1.1 | SUSE-SU-2026:24641-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | rust-keylime | 0.2.10+12-150500.3.22.1 | SUSE-SU-2026:4931-1 |
| SLE Micro 5.4 | rust-keylime | 0.2.10+12-150400.3.22.1 | SUSE-SU-2026:4930-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-uv | 0.13.6-1.1 | openSUSE-SU-2026:12307-1 |
| openSUSE Leap 16.0 | rust-keylime | 0.2.10+12-160000.1.1 | openSUSE-SU-2026:22249-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ascan +1 | No fix yet | — |
| Wolfi rolling | pixi | 0.84.0-r0 | — |
| Wolfi rolling | pnpm-12 | 12.18.0-r0 | — |
| Wolfi rolling | ruff +1 | 0.17.4-r0 | — |
| Wolfi rolling | superset-6.1 | 6.1.0-r25 | — |
| Wolfi rolling | verus | 0.2026.10.18-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | zip | >= 5.1.0, < 9.0.0 | 9.0.0 | GHSA-9hj8-73fh-9963 |
Advisories 6
- SUSE-SU-2026:24658-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Nov 12, 2026
- SUSE-SU-2026:24641-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Nov 12, 2026
- openSUSE-SU-2026:22249-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Nov 11, 2026
- SUSE-SU-2026:4931-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Oct 31, 2026
- SUSE-SU-2026:4930-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Oct 31, 2026
- openSUSE-SU-2026:12307-1 python313-uv-0.13.6-1.1 on GA media SUSE / openSUSE Security Updates · Oct 28, 2026