← Packages
rust-zip-8
Rust crate "zip"
- Current
- 8.6.0
- Candidate
- Stale
- Release line
- 8.x
- License
- MIT
Advisory · 8
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEOSV
- Fixed events
- 9.0.5OSV
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.32%FIRST
- Returned advisory
- GHSA-m665-v7pm-7grjOSV
- Aliases
- GHSA-m665-v7pm-7grjOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:LOSV
- Summary
- zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeOSV
- Fixed events
- 9.0.0OSV
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.35%FIRST
- Returned advisory
- GHSA-9hj8-73fh-9963OSV
- Aliases
- GHSA-9hj8-73fh-9963OSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOSV
- Summary
- zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.OSV
- Fixed events
- 9.0.0OSV
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.432%FIRST
- Returned advisory
- GHSA-hjqx-j4rw-g7xvOSV
- Aliases
- GHSA-hjqx-j4rw-g7xvOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:HOSV
- Summary
- zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionOSV
- Summary
- zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared sizeOSV
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.461%FIRST
- Returned advisory
- GHSA-q7v9-x93c-xqv3OSV
- Returned advisory
- RUSTSEC-2026-0429OSV
- Aliases
- GHSA-q7v9-x93c-xqv3, RUSTSEC-2026-0429OSV
- KEV
- NoCISA
- Summary
- ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the targetOSV
- Fixed events
- 9.0.0OSV
- Returned advisory
- RUSTSEC-2026-0369OSV
- Aliases
- RUSTSEC-2026-0369OSV
- EPSS (no CVE alias)
- not applicableFIRST
- KEV (no CVE alias)
- not applicableCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HOSV
- References
- Advisory · rustsec.org
- Summary
- zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directoryOSV
- Fixed events
- 9.0.0OSV
- Returned advisory
- RUSTSEC-2026-0368OSV
- Aliases
- RUSTSEC-2026-0368OSV
- EPSS (no CVE alias)
- not applicableFIRST
- KEV (no CVE alias)
- not applicableCISA
- References
- Advisory · rustsec.org
- Summary
- Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege EscalationOSV
- Fixed events
- 9.0.0OSV
- Returned advisory
- RUSTSEC-2026-0367OSV
- Aliases
- RUSTSEC-2026-0367OSV
- EPSS (no CVE alias)
- not applicableFIRST
- KEV (no CVE alias)
- not applicableCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HOSV
- References
- Advisory · rustsec.org
Description
Source code for takopackized Rust crate "zip"
Changelog
PR · 1
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Stale Repository refresh: git fetch exited 128 (authentication) | ||
Stale Source last confirmed at 2026-11-12T12:09:42+00:00; repository refresh overdue. | ||
Checked | ||
Checked | ||
Not configured No reliable monitor identity/configuration. | — | |
Not applicable No confirmed version upgrade; this monitor is not run. | — | |
Checked | Last attempted | |
Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated. | Last attempted | |
Checked | Last attempted |